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FEDERAL BUREAU OF INVESTIGATIOS 


Date ef camserig 


i Ls pos T 
stigation (FBI Special Agents | К шиш 


jeld Office, 601 47 Street 
Attorney at Law, at 
andi from the Department of Justice DOR 
port Centro! Section. Prior to the inter en = oo: to sign a pon- 
sure agreement in anticipation of viewing classified documents during the iniervigw, Aller being 
advised of the identities of the interviewing agents, and the purpose af the T E] 
peavided the following information: 


1 Bureau v 
bington P 


gae did not bave freg act with the Secretary e£ State when 
This wats because! led all of the direct 
d инсан ор» with the Secreury and her team himself described his role under 
БЫШЫШЫ being external facing Не! pag explained that he was ss à ac coordinating 
with Congress and fucifitating other пуда economie en ne more 


fucused on Afghanistan matters when became the Jesse 
focus mainly on Pakistan. fn this role, 


wanted us 


a жөнө) provided that he primarily interacted with the КАКАЧЫ i 
Seeretary's team: CHE ext LES tor USAID and cor icatí 


apaty Committee or Principal Committee meetings: HOMA ABEDIN 
for communivatioas matters. noted that he E L 1 


пме нмана of de FBE Hix 


эз 


TOTE 


HRC-59 


bl 
b3 


b6 
b7C 


b6 
ътс 


b6 
ътс 


b6 
ъ7с 


b3 
b7E 


b6 
b7C 


bl 
b3 


изн oi FD- 302 uf. 


iOH [С Деак directly with SULLIVAN an 
needed the Secretary's aitention. Exaninies include topics that invaly 
коны potentially impuct DoS equities, and topics involving priv 
fied or unclassitied depending on the speci 
ail system. 


s sector engagements, These exchanges. 
could he either cla content and were done via the 


te wephone er e 


had an OpenNet and ClassNet account but be did aot have 
a Blackberry, which was linked to fis unclassified DoS 
used his Blackberry email extensively when he was 


ted 


1 for his home. 


a mede оча only recall one instance following the birth of his son when be 
received an email directly front thy Secretary, He remembered that the email came tram a non-DoS email 
account but he didn't think much of it at the time the Secretary was using 
a private email account and server to conduct DoS bu: aware of any other DoS 
sniployves using persunal email accounts (ог official business, provided that he had the 
personal email addresses of both SULLIVAN and MILLS bat he did not recall ever using those accounts 
for otficial business. 


confirmed that he was read into a Special 
Access Program understood the 


sensitivities surrounding the program asd the need to appropriately safeguard related informatio: 
such. the DoS stance was vot to publicly comment on the program. 


as shown а copy of an email chain from 
December of 2011 with the subject ^t A fier reviewing the emal stated that he did not 


remember the circumstances in which the email was originally sent. However. based on the email time 


stamp believed he was in California when he reccived the email shai be would not have 
bad any other means of forwarding the information to those who needed it, stated that 
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за information on the unclassified system was not ideal Pul that be often 
ad A $ ^ beat ane E bl 
did not have a choice wher ame Bi tire sensitive information. not b3 
ify waiting or guidance on how time sensitive information should be transmitted 
was shown a copy of аз emait chain from 
did not remember the ever afier 
bl 
b3 


did not have concerns sending this type of information on an 
se the story was about to break in the news and ft was important that th 
ihe information to the Secretar y betore that occurred. 


Lan email chain from 
I stated ii was sent prior to 
Use referenced article being released in the pre: could not recall any further details about the 


inforpiution + oh eet Ue noted that a number af similar stories were being ecleasud by the b1 
А : e dA А F b3 


press ut that time: believed that the information in the emaif could be treated as unclassified 


bevause the arüele was about to be refegsed and it was critical that he notify the appropriate people within 
Dos. 


with the subject 


provided that the emaif was forwarding а news article of merest to individuals within DoS bl 
stated That the comments he included when he forwarded the email were not meant to confirm the veracity b3 
ofthe news article but rather to express his frustration with the ariete further explained that 
2011 was à particularly difficult period for bilateral relationships in the region and that DoS efforts were 
offen complicated by such articles. 
was shown а copy ofan стан chain from Мау bl 
or 201 with the subject ч 3j the email but b3 
noted that И was anusani f provided that he 
forwarded the email because it was a matter that required the immediate attention of DoS to preserve 
аник» 
(ОРЕВА 59 At the conclusion of the iere [erm that none af the emails that he ae 
wats shown were originated by him. The emails either volved ialorniation that was shout to be n ed 
publ or were authored by another individual. 
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Daic of transcription _ 2/4/2016 


(U//FOUO) On February 3, о telephone number 
was interviewed by Federal Bureau of Investigation (FBI) S 

at the offices of 
DC. Also present for the interview wa: Principal, whom 
asked to sit in on the interview. After being advised of the identities of the interviewing agents, and the 
purpose of the interview, rovided the following information 


U/FOUO) 


(шжөнө[ ^ fice at DoS was located on beni m Row," a term given to the 


Executive hallway where the Secretary of State' s office is also located eld a Top Secret 


(TS), Sensitive Compartmented Information (SCI) clearance while at DoS, and handled classified 
information on a daily itt pm MD MEME psp 577 copies of 
the Presidential Daily Brief (PDB), the dissemination of which was restricted to only the highest positions 
in the United States Government 


(U/FEHO) When[ ^ heeded to communicate something classified to cuwoN[ | 
would walk down Mrd ea Row" and talk to CLINTON face-to-face. If CLINTON was not in t 


office, or on travel, and needed to discuss classified information, would contact 
CLINTON via a secure phone or send her a secure memo. 


dies: BR, not aware that CLINTON was using a personal email account while 
she was Secretary of State, nor di ecall what адатеѕ урей in or saw web je emails to or 
received emails from CLINTON assumed whatever devices CLINTON used to conduct 
business while she was Secretary of State were approved, because nobody at DoS used devices without 


approval. as not aware of any DoS policy against using personal or private email accounts 
to conduct unclassified DoS business. 


Investigation on — 2/3/2016 ai Washington, D.C. 


re [ —— фо Date dictaicd — N/A 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency: it 
and its contents are not to be distributed outside your agency. 
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U/FOHO) On a few occasions, raveled масын CLINTON. However, the majority of bé 


travel whid jw was done so o[ b "wn. Bis 
(U//FGUO) Agents asked a 2013 speech to the b6 
American Foreign Service Association, s 


b6 
b7C 


(umeseyg explained the quote was in response to a question rri regards b6 


to how business had changed at DoS since| PRESIDENT CLINTON' s administration. BIG 
further explained that sanford Bc assignment to Do nobody at DoS 

had access to unclassified systems of an Blackberries didn't exist, and unclassified computer 

systems were not yet installed at DoS. The only way to communicate during that time period was via 

cables and on the telephone. In contrast, заре to DoS л рн access to 

SIPRNet, JWICS, and Unclassified computers, as well as unclassified Blackberries, and secure iPads. 


the above statement [ — ]was trying to explain how technology has allowed for a 
different form of information flow, and ultimately sped up the way in which DoS does business. 


(О/ЕӨНӨ! further cared] BEN Ба abovein[ poi3 Ht 
speech, was unclassified, as not implying that information CLINTON may have been 


communicating classified material on her Blackberry concerning the unclassified matter. 


(U/FeHO)Itwas| ^ Jopinion that everybody at DoS takes security very seriously and b6 
understands the importance of protecting sources and mehods ibe there is а ETG 
misconception about how DoS classifies documents, and further explained that generally the only way to 

discuss topics with Foreign Partners is via unclassified channels, or in very sensitive cases, by making 
arrangements to meet in person at Embassies or at DoS. Since there isn't a classified system that allows 

DoS to communicate with its foreign counterparts, conversations that are held with foreign partners in 
unclassified channels are later “up-classified” to Secret to protect the information 


(U/FOUO) In defense of DoS practices. shared a stor foe i ER d Be 
with then FBI Deputy Director MARK GIULIANO, wherein]  |state: E i GRE frequently with bic 
GIULIANO via email. [stated h ad the upmo: ect for GIULIANO, but believed i 


was to Sel dimer email pore Ela with GIULIANO. ould find emails that some would 
consider sensitive 
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(U/FOUO) When received a request to produce documents in response to Freedom 
of Information Act (FOIA) inquires, Iso queried and produced emails from ersonal Gmail 
account tha: etermined were *even remotely related to work." sometimes sent short b6 
emails 10] amily via Gmail while as on travel and felt that i eferenced negotiations or b7C 
anything concernin qoe at DoS, should produce th uments in an abundance of caution 
amu es | r explained that it not uncommon mg have. personal Gmail 
account to ліса while on travel, because there were often times| ‘ould not access her DoS 
unclassified account. ‘ould try to copy her DoS email account on any DoS related 
communication ay have sent from her Gmail account. 

(Uee ]lwas ware of any specific instances shed ceived notification b6 
concerning a potential hack of any o mail accounts (DoS or personal) or the email accounts of other BIG 
DoS employees. However, explaine as sure people tried to hack into ersonal 
email account and the accounts оѓ i 
Iran negotiations. Specificall 
received a similar email. reported the incident to DoS Diplomatic Security who reportedly 
traced the emails back to a bl per DOS 


(U//FGUO) A copy of the original interview notes are attached in a 1A envelope. 
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FEDERAL BUREAU OF INVESTIGATION 


Daic of transcription _ 09/17/2015 


ueso — ]шеоып[ J] wes interviewed at the 
offices of PLATTE RIVER NETWORKS (PRN), 5700 Washington Street, Denver, Colorado 80216, by 
Federal Bureau of Investigation (FBI) Special Agents (SA and 
Also present during the interview were] attorney, U.S. Department of 
Justice an attorney at After being advised of the identity of the 
interviewing agents, and the nature of the interview. provided the following information: 


(U//FO'8O) In mid-201 С was selected to provide technical support on a contract 
PRN had acquired for the management of a new server used solely for email exchange for domains and 
accounts associated with BILL CLINTON, HILLARY CLINTON and their aides under the PRN account 
name CESC (CESC client). е company InfoGrate to be the contact who initiated the 
PRN contract with the CESC client understood the CESC client was already using email 
domains hosted on a server out of their residence in Chappaqua, New York, and in order to effect the 
transition to the PRN managed new c mE CE to understand the needs of the client and 
the configuration of the server being housed in Chappaqua was put in contact with 
BRYAN UE чечи to be the administrator of the server in Chappaqua. 
PAGLIANO grante remote administrator access to the server under the administrator user 
name Eez and in mid-2013{ Пош in to the server at Chappaqua 


(ӨНӨ |] described the physical equipment comprising the email server at the 
Chappaqua residence as a Dell PowerEdge 2900 (PowerEdge 2900) running Microsoft Exchange 2007, a 
Dell PowerEdge 1950 (PowerEdge 1950) being solely used as a BlackBerry Enterprise Server (BES), a 
Cisco NSS 324 for Network Attached Storage (NAS), a switch, a firewall and a Uninterruptible Power 
Supply (UPS). The PowerEdge 2900 server hosted the email domain presidentclinton.com, wjcoffice.com 
and clintonemail.com, and had 20 to 30 email accounts associated. The PowerEdge 2900 was used 
exclusively for email, with no file or print options. The PowerEdge 2900 had Microsoft Forefront 
security and Norton Symantec anti-virus software installed on it. No one but PAGLIANO had 
administrator rights to the PowerEdge 2900 seve[ — Jbetieved the Chappaqua residence had 
Comcast as an Internet Service Provider (ISP). 


(U//FO'8O) In order to effect the transition from the foregoing server equipment in the 
CLINTON's residence in Chappaqua to the new PRN server infrastructure and service, CESC and PRN 


Investigation on — 09/13/2015 at Denver. Colorado 
rice ро Date dictated — N/A 
Bys sal 
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arranged a time to power down the equipment in Chappaqua, transport it to a data center and migrate the 
existing email accounts and domains to the new server infrastructure being provided by PRN 


(U//FOGHO) On or around 06/22/2013, and based on an infrastructure plan as part of a Service 
Level Agreement (SLA) to provide the CLINTONs with new ий с eel a PRN 
employee, setup a Dell PowerEdge 620 (PowerEdge 620), two PowerConnect 2824 switches, two Fortinet 
firewalls and a Datto SIRIS 2000 (DATTO), and hooked them up in a rented space at Equinix, a data 
center located in Secaucus, New Jersey 


(U/POBO) On 06/23/2013] þrraveled to the CLINTON residence in Chappaqua and 
picked up the PowerEdge 2900, the PowerEdge 1950, and the NAS, while leaving the switch, firewall and 
UPS at the residence [lesan the equipment to the same rented space at Equinix as the 
PowerEdge 620, where plugged in and networked all the equipment to get it back online in 
order to provide CESC with continued email access. LJplugged in the NAS, but according to 

| no email archiving or back-up was on it and it appeared to only have install files. The NAS 
was not configured to archive email BL re PRN at any amelo diesel the mail 
exchanger (MX) record to specify the transition to the new IP address and configuration at Equinix. 


(U//FOHO) On or around 06/30/2013[— began the email migration for all CESC 
accounts from the PowerEdge 2900 to the PowerEdge eT bere this by right-clicking 
on individual mailboxes and migrating them over one at a time. stated he brought over the 
entire content of all the mailboxes from the PowerEdge 2900 to the PowerEdge 620 as there was no way 
to do it “piece meal” or partial ly. Jdescribed the migration process as more of a “sync” and 
once the servers “agree” that the mailbox is moved, the mailbox is removed from the old server. As a 
result of the migration, no email content existed on the PowerEdge 2900. During the migration, the 
PowerEdge 2900 and 620 worked together in the same exchange, where the servers agree that each email 
sent or received is an identical copy. ЕР нана У, the PowerEdge 620 to host а 
Blackberry Enterprise Server (BES) and a Domain Controller as virtual machines = A] 
explained the Domain Controller as being used for password and authentication requests. The PowerEdge 
620 was also running Microsoft Exchange 2010 software, which was an upgrade from the software on the 
PowerEdge 2900. Additionally, as part of the new server infrastructure provided by PRN, 

configured the DATTO back-up device to take multiple snapshots of the server a day that purged at 60 
dayintervals[ — also configured both sets of firewalls and switches for redundancy in case one 
went down. After several days of migration, the PowerEdge 620 had all email mailboxes migrated to it 
and was processing email on Microsoft Exchange 2010 for the email domains presidentclinton.com, 
wjcoffice.com and clintonemail.com pos d "very confident" that all email had migrated from 
the PowerEdge 2900 to the PowerEdge 620. At some point later |remembers adding the 
=] to the PowerEdge 620. After total migration, PRN decided to keep the 
PowerEdge 2900, 1950 and NAS running, even though it was no 
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longer processing email, in order to ensure email was being delivered without failure through the 
PowerEdge 620. There was no official user security policy to have an account on the PowerEdge 620. 

ee the Secure Sockets Layer (SSL) certificate for the domains hosted on the 
PowerEdge 620. Additionally, PAGLIANO Pt mE credentials for the clintonemail.com 
domain, registered at Network Solutions. 


(U/7FO'3O) On or around 12/2013, PRN made the decision that email delivery was working well 
after the migration from the PowerEdge 2900 to the PRN managed PowerEdge 620. In order to power 
down the PowerEdge 2900. prated Microsoft Exchange 2007 would need to be uninstalled 
from the PowerEdge 2900, or the PowerEdge 620 would generate error messages. 
uninstalled Microsoft Exchange 2007 from the PowerEdge 2900 by clicking on uninstall and following 
the system prompted checks to ensure there were no ties between the PowerEdge 2900 and the 
PowerEdge 620 and no active mailboxes were on the PowerEdge 2900. From that point on, the 
PowerEdge 2900, 1950 and NAS sat disconnected in the cage at Equinix until the FBI picked up the 
PowerEdge 2900 on 08/12/2015. The uninstallation of Microsoft Exchange and powering down of the 
PowerEdge 2900 was an action taken by PRN as standard protocol without order or direction from the 
CESC client. 


(U//FO8O) Based on his experience] — Јанета PAGLIANO's set-up on the 
PowerEdge 2900 as a standard email set-up, also described his set-up on the PowerEdge 
620 as standard. Moreover, ——  |described that email messages accepted by the PowerEdge 620 
would first go through MX Logic, a third party company that removes viruses and spam before sending 
the message through Giglinx, the Internet Service Provider (ISP) at Equinix. From е a) 
could not recall if the email would go through CloudJacket or the firewall, but he knew they were in 
succession. CloudJacket was an appliance used for intrusion prevention on the PowerEdge 620. 
CloudJacket had pre-configured settings that would block or blacklist certain email traffic it identified as 
potentially harmful. Occasionally, CloudJacket would send email notifications t as the 
system administrator, prompting him to block certain IP addresses. described these 
notifications as normal and could not recall any serious security incident or intrusion attempt that he was 
aware of. LLL koua not identify any IP addresses, or their country of origin, that were involved 
in a brute force attack (BFA) against the PowerEdge 620. Email traffic would then go through the switch 
and to the PowerEdge 620 where it would be processed by Microsoft Exchange 2010. Additionally, 

installed Trend Micro AntiVirus and later, Webroot AntiVirus 


(U/FOgHO[ stated the CESC client originally requested to encrypt email such that 
no one but the user could read the content. This, ultimately, was not the way the email was configured so 
that system administrators could troubleshoot all р occurring within user accounts 7) 


recalled ind las having system administrator rights to the PowerEdge 
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620, although þbelieved he handled almost all issues entirely ]was seldom used, if at 
all, for work on CESC. System administrators could move mailboxes, change and reset passwords, and 
sometimes view email for archive searches when the users didn't have the time and CESC requested PRN 
complete the task. After PRN took control of the server, the CESC client never requested another 
individual have administrator access| — Jstated BRYAN PAGLIANO's password for the 
PowerEdge 2900 was changed and he did not have access to the PowerEdge 620. The CESC client did 
request 24 hour access to someone who could assist with any issues that should arise regarding their email 
accounts. In order to meet this request, PRN contracted with Level Platforms or Managed Workplace, a 
third-party company used for troubleshooting and help desk related issues for any late night or off-hour 
requests Male lead not handle. The third-party company did not have administrator access 
to the server or email content, but could provide assistance with troubleshooting devices, connectivity to 
the server and password resets. stated the help desk service was not used often and the 
CESC client would contact him directly | was unsure, but thought the third party help desk 
service was no longer contracted with PRN for CESC client help. 


(Us, In or around ox2014[ was contacted by someone from CESC, that he 
recalled a Last Name Unknown (LNU), informing him that she was going to ship him a 
MacBook containing a folder with old HILLAR ails] recalled no other 
identifying information regarding SO the MacBook being shipped via 
FedEx to his personal residence in| but does not recall any other information regarding the 
shipment. Oncel received the MacBook, he identified the folders containing the HILLARY 
CLINTON email and recalled five subfolders being labeled 2009 through 2014 did not 
recall the specific HILLARY CLINTON email account the tranche was from created a 


п account was not configured to send or receive email messages. 


someone from CESC, requested that only HILLARY CLINT ociates be granted access, 
but could not recall the names of the associates shipped the foregoing 


MacBook back to] LNU, but recalled nothing about the return shipment. 


local storage folder under the address hrearchive@clintonemail com and copied the pst files to it, Th 
or 


(О/ЕӨЊЮ) In or around 09/2014 ]was contacted by CLINTON aide CHERYL 
MILLS requesting perform an archive search of all HILLARY CLINTON email, during her 
tenure as Secretary of State, from 01/2009 to 02/2013, sent to or received from an email address ending in 
.gov. It was originally requested thal Тыт the foregoing archive search to a DVD and 
FedEx it to CHERYL MILLS. Instead of that usual - .- endie the foregoing archive 
search, zipped the resulting .pst email files, encrypted them with AES256, and used a 
Secure File Transfer Protocol (SFTP) to transfer the files to the workstations of CHERYL MILLS and 
HEATHER SAMUELSON. Additionally. password protected the pst files. Sometime 
shortly after, CHERYL MILLS contacted and asked him to perform another archive search 
for all email on all accounts in HILLARY CLINTON's mailbox during her tenure as Secretary of State. 
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LLL Jeonducted the requested archive search and transmitted it to MILLS and SAMUELSON 
using the same process, an SFTP transfer using AES256 encryption to their personal workstations. 
[S no additional detail regarding the workstations of MILLS and SAMUELSON 
Additionally, the archive search conducted E sa] did not contain email from the local storage 
i lcom. 


U//E999) In or around 12/2014 was put in touch with an individual named 
p someone from the CESC client informed. __ Jihat HILLARY 
CLINTON and HUMA ABEDIN were going to have new email accounts on a new domain hosted on 
another server not administered by А 


nformed|______ that HILLARY CLINTON's 
п and НОМА ABEDIN's new email address was 
requested thal begin forwarding the email from HILLARY 


CLINTON's lintonemati com account, hosted on the PowerEdge 620, to her new 
С s ow, account, hosted on another server unknown М ay nor anyone 


from the CESC client, re uesed| Дю transfer any archived email to the new serve] d 
l ay i not aware of any detail related to the new server referenced by] 


to include who managed it or what it was being used for. 


(U//FGHO) In or around os2015[ Ммаѕ contacted by CESC with a request to 
inventory the CESC mailboxes to determine what exists, where it was stored and how it was backed up. 
arx akea wih[ — фо coordinate the request and it was decided| оша 


travel to Equinix to ensure the PowerEdge 2900, 1950 and NAS contained no email data. Once onsite at 
Equinix owered on the PowerEdge 2900, 1950 and NAS and verified no old email data or 
backups existed. When eturned to Equinix in 08/2015 to provide the PowerE 


dge 2900 to 
the FBI, he powered it up to check for any email or backup data. The 08/2015 inventory pce 
was not requested by anyone from CESC and was a step taken by PRN. 


(цш өнө] ^ ] stated all email accounts on the PowerEdge 620 had some back-up 
policy. Everything on the PowerEdge 620 was backed up through the DATTO device by taking several 
snapshots of the server daily and maintaining the data for 60 days. Additionally, all accounts had some 
back-up set by the user in their individual email client settings. Users could also archive email locally, by 
making .pst files on their computer workstation for Mugs... tad the server just presents 
the email to the user — after that, the user could do whatever they want with the email Г 
not know what any CESC client individual email user’ ѕ setting was. Additionally, in or around 
08/06/2015, PRN was made aware that DATTO was syncing with the DATTO cloud and storing email 
data related to CESC off-site. This off-site logging to DATTO's datacenter was not requested by PRN or 
CESC. Once the DATTO offsite logging was discovered, DATTO disabled the offsite logging feature 
leaving DATTO with 60 days of CESC email back-up from the day it was disabled 
believed DATTO was preserving the offsite email data. 
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шене] was shown a list of CESC email accounts provided to the FBI by PRN. 
recognized most of the email accounts and knew that some were added and deleted 
throughout the life of the contract, but couldn' t give a timeframe for the addition/deletions and wasn't 
aware of all of the users for each account. Additionaly[ — Jwas unaware of the devices used by 
each user. When CESC users would acquire a new mobile device, they could configure it themselves due 
to Microsoft ActiveSync technology on the mobile device. On rare ocesions| ^ would have 
to assist old blackberry users with synchronization with the BES. 


(U//FG8O) PRN set-up a share folder on the PRN network for all documentation related to the 
CESC client believed PRN took this step to limit the individuals at PRN that had access to 
information regarding the CESC client 


(u/ese[ ^  ]believed that PRN never used the company Techno-Rescue to recycle 
any equipment related to the CESC account, believed that PRN never used Veeam software 
or service to backup the PowerEdge 620 


(U//FGUO) PRN never took action to purge or delete CESC email data from the PowerEdge 620 
or DATTO. CESC never requested that PRN purge or delete email data associated with their account. 


(U//FOJSO) was aware of no discussions with CESC regarding classified 
information or retention of federal records. 
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(U/POHO) On February 18,2016. — date of birth] was 
interviewed by Federal Bureau of Investigation (FBI) Special Agent (SA land SA 
tse CE: "^ the offices of Platte River Networks (PRN), 5700 Washington Street, Denver, Se 
CO. Also present for the interview were $А[ 1] Information Technology Specialist/Forensic ътс 
Department of Justice (DOJ) Айу d 
After being advised of the identity of the interviewing agents and 
provided the following: 


the nature of the interview. 


(U/EGUO) MONICA HANLEY contacted| ^ via email on or about February 2014 
regarding email belonging to HILLARY CLINTON. The email was stored on a Macbook and CLINTON 
did not want to lose the email, so HANLEY requested transfer itto the Clinton Executive 
Services Corporation (CESC) server (Server) managed by PRN. The Server housed four virtual b6 
machines: a Microsoft Exchange server, a BlackBerry enterprise server, an administrative server, and a ьтс 
domain controller L attempted to accomplish the task via a remote session using a remote 
support application called ScreenConnect. focal === = was unable to import the files using 
ScreenConnect since the email was stored in the Macbook's Mail program. Therefore, had 
HANLEY ship him the Macbook so he could import the mail files manually. 


(U//FO't3O) Upon receipt of the Macbook[  Jreviewed the files and noticed there 

were several mail folders and each was labeled with a different year from 2009-2013. He then conducted 

a Google search to identify an appropriate method for converting the Mac Mail files into .pst files. 
oe believed he used Gmail as a way to convert the Mac Mail files to a format that could be 

imported into the Microsoft Exchange server. Once the conversion was complete, he created a new b6 
mailbox named HRC Archive. It was likely a regular Microsoft Exchange mailbox that could send and bic 
receive email. [2:2 Y: not recall who had access to the mailbox. Once the import onto the 

Server was successful, he deleted the email from the Macbook, but did not use any data wiping tools on 

the Macbook. С ег deleted the HRC Archive mailbox from the Server and believed it 

should still exist there today; however, users with access to the mailbox could have altered its contents. 


Investigation on, 02/18/2016 at Denver, Colorado. ъз 
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(U/FOUS) In April 2014, remotely instructed how to 
access the HRC Archive mailbox using Microsoft Outlook on her computer. likely 
provided this assistance using the ScreenConnect application. 
(U//FOUG) After reviewing several documents dated in and around July 23, zu[ |] 
stated in July 2014 he had a conversation with CHERYL MILLS during which she requested 
export a .pst file with all email in CLINTON's mailbox that was sent to or received from a 
.gov email address (July Export). After reviewing a list of .pst files modified in or around the same time, 
[potes he might have attempted the July Export using different tools, such as Outlook or 
PowerShell, He did not recognize the file name export.pst. After completing the July Export and 
verifying it would open correctly in Outlook, burned DVDs of the files and arranged for a 
FedEx pickup the next day. However, MILLS susequently requested a secure electronic transfer of the 
files instead of shipping physical media. Once the secure electronic transfer was complete, 
destroyed the DVDs by breaking them in half. 


(U//FG'9O) After reviewing a July 24, 2014 email from BRYAN PAGLIANO regarding a regular 
expression text editor, explained when a user changes his or her email address, Outlook 
updates the old email address with the new email address. MILLS was concerned CLINTON' s then- 
current email address would be disclosed publicly and would be different from the one CLINTON was 
using at the time the emails were actually sent. mmn PAGLIANO discussed using a regular 
expression text editor to find and replace the new email address with the old, but the tool could not 
accomplish the replacement. 


(U//F8U9) Г] used the email address[ — — — —  Jàgmeil com as an account 


to test email flow when he worked on the Server. It was a *dummy" account he used to test email issues 
for various PRN clients 


(U//FGUG) After reviewing work tickets from July 29-30, 2004[ ] stated the 
ScreenConnect remote sessions with MILLS and HEATHER SAMUELSON were for the purpose of 
transferring copies of the July Export to their Windows workstations. Prior to the d e EP 
password-protected the .pst, then placed it in an Advanced Encryption Standard (AES) zip file. The 
ScreenConnect tunnel was also encrypted, resulting in three layers of protection. 


(U//FOUO) After reviewing an invoice dated August 12, 2o14) esed he assisted 
SAMUELSON in reconnecting to the July Export archive. 


(U//FG'UO) After reviewing a work ticket dated September 29, 2014 and invoices dated 
September 30, 2014 and October 1, 2014, stated he spoke with MILLS about the creation of 
a new email archive export (September Export)! could not recall if the September Export 
consisted of the complete live mailbox belonging to CLINTON, the exported emails from the HRC 
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Archive mailbox, or both. The September Export was several gigabytes in size. Сав пої 
place any limitations or delete any content from the September Export. 


(U//FOUS9) After reviewing a work ticket dated November 18, 2014 Jstate he 
worked with SAMUELSON to reestablish her connection to an archive of CLINTON' s emails. 
could not recall if it was to the July Export, the September Export, the live HRC Archive 

mailbox, or something else 


U//FGUO) After reviewing a work ticket dated November 24, 2014 and an email dated the same 
day. stated he participated in an urgent call with SAMUELSON regarding more specific 
export requirements. He could not recall the details of the conversation 


U//FG'UO) After reviewing an administrative server log file from November 24, 2014, 
as he used Microsoft Outlook on the administrative server to test any .pst fi 
exports he created for CESC. The testing consisted of opening the . pst files to ensure they loaded into 
Outlook correctly. 


* Regarding Outlook Office Alert event log entries indicating a mailbox and a “gov export” 
folder were deleted, þpeculated they were deleted because they were no longer 
needed on the administrative server. 

* Regarding the log entry referencing “huma-gmail-yahoo.pst.ink,"[____]stated HUMA 
ABEDIN requested her email from Gmail and Yahoo be imported into her mailbox on the 
Microsoft Exchange server. [рош not recall when ABEDIN requested this 
assistance 


в 


(U//FOGUO) After reviewing a document where “HRC Archive” is referenced in the Windows 
Messaging Subsystem profile for mpl — stated he believed this file to be a reference 
related to the transfer of email from the Macbook he received from HANLEY described above. 
Specifically[ ^ ^ believed he used the Gmail account реотай.сот to 
effect the transfer to the HRC Archive mailbox. He might have used the Macbook for this process, but 
probably used the Server. 


(U/FERO) After reviewing emails dated December 10, 2014 and December 12, 2014, as well as 
work tickets regarding December 9-10, 2014 telephone calls with MILLS and SAMUELSON, 
stated they wanted the last 60 days of email for CLINTON and ABEDIN in new accounts 
that were not on the Microsoft Exchange server, but did not request the migration of any other content. 


(U//FOUO) After reviewing an email dated December 11, 2014 with the subject line “RE: 2 items 
for IT support," and a December 12, 2014 work ticket referencing email retention changes and 
archive/email cleanup Jstated his reference in the email to “...the Hilary [sic] coverup [sic] 
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operation...” was probably due to the recently requested change to a 60 day email retention policy and the 
comment was a joke. He did not recall the prior retention policy. 


(U//FO8'8O) After reviewing a work ticket dated January 5, 2015, referencing a remote session 
with MILLS and SAMUELSON, stated the session was possibly to remove the July Export 
or September Export .pst files from their workstations. 


(U//FGU9) After reviewing a Server log entry from January, 5, 2015, noting the installation of 
Ontrack PowerControls сы PowerControls was the software utility 
bundled with the Datto backup device employed as part of the CESC Server architecture. It is used for 
Microsoft Exchange server restoration, ^ pA {5 not recall ever taking any actions with it 


(О/ЕӨНӘ) After reviewing a document identifying the “Last Written Time" as January 6, 2015 
for “HRI v email Archive.pst, HRC .gov emails.pst, HRC gov emails.pst, and export.pst," 
раи Outlook updates the modification time and date for any .pst files attached to a mail 
account when the program is opened. 


(U//FOUO) After reviewing an email dated January 7, 2015 containing a list of mailboxes on the 
CESC Cu ae he believed the HRC Archive mailbox should still be on the Server in 
the possession of the FBI. He did not know why it would not be on the server and said he would check 
the current server for the existence of an i ail e content of a 
mailbox, but not the existence of it. оа had the capability 
to login to the Server as an administrator and remove a mailbox stated he did not remove 
the mailbox, nor did anyone request he remove the mailbox 


(U//FOUO) After reviewing administrative server log entries ranging from January to October 
due np mlipis ОооыесАрр айе | 
Google Apps for business, so he used Google migration tools to pull the email accounts of users from her 


office to the Microsoft Exchange server. January 2015, however, was not the correct timeframe for that 
migration ааа not recall what he might have used Google Apps for in January 2015. 


(U//FG'UQ) After reviewing an email dated March 5, 2015, referencing} from 
Security Pursuit, stated he did not knowl Jand did not recall implementing апу 
new security features during that timeframe. 


(U//FOUO) After reviewing an email dated March 3, 2015, referencing a .pst file containing all of 
“HRC's emails to/from any .gov addresses"[ — ]заей he used filters based on sending and 
receiving email addresses, as well as a date filter for CLINTON' s time as Secretary of State to produce 
the July Export. 
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) After reviewing an email dated March 5, 2015 with the subject line “RE: Share," 
stated the shared drive was located on PRN hardware in Denver. It was a limited access 


shared drive for individuals working with CESC. 


(U//FOUO) After reviewing an email dated March 5, 2015 with the subject line “RE: CESC 
Firewall,” stated “...HRC's backup device...” referred to a second mobile device that 
belonged to CLINTON. He did not recall any details about the device 


(U//FOGUO) After reviewing a document with information concerning “export.pst, HRC archive — 
complete.pst, and hrcarchive@clintonemail.com - HRC uve ae ete], based on the 
Last Written Time in the registry, that export.pst existed on the administrative server as of March 7, 2015. 
He did not recall when it was removed or who removed it from the administrative server 


(U//FOUO) After reviewing work tickets from March 7-8, 2us[ stated he 
determined the Cisco Network Attached Storage device brought to the Equinix data center when PRN 
took possession of CESC's predecessor server and associated equipment did not contain any email 
content. PAGLIANO had used it for extra storage and it only contained BlackBerry server logs. 

did not know what was on the external USB hard drive that was also part of the predecessor 
server architecture. PRN did not use either device as part of the Server architecture they designed and 
implemented. 


(U/A After reviewing an email dated March 9, 2015 with the subject line “Re: Email/Data 
Systems," wher is listed as one of the recipients, [stated he did not recall 
seeing the preservation documentation from DAVID KENDALL referenced in the email 


(U//FOUO) After reviewing work tickets dated March 10, 2015 and March 12, 2015, referencing 
the movement of email for oH MILLS did not have an account on the Server 
and he could not recall what work he might have done for MILLS. MILLS occasionally contacted 
С J with problems related to her personal email account, so the work tickets may have been of 
that nature 


(U//FOUO) After reviewing an email dated March 25, 2015 with the subject line “CESC call,” 
LLL ава he had no recollection of the call or what it was about. pe reviewed 
an email dated March 25, 2015 with the subject line “Clintons” and a work ticket dated March 31, 2015 
referencing a conference call with KENDALL and MILLS. At this point in the interview, 

ни s counsel, advised not to answer any questions related to conversations 
with KENDALL based on] protections under the Fifth Amendment. 


(U//FOUO) After reviewing log files dated March 31, 2015, referencing multiple manual 
deletions from the Datto server used to backup the Server, stated he did not recall 
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erforming the deletions, nor did he recall being asked to delete backups from the Datto server. 
nets stated everyone at PRN has access to the Datto client portal, which is used to 
manage the backups for all of PRN's clients who employ Datto's services. 


(U//FOUO) After reviewing log files dated March 31, 2015, referencing the installation of 
BleachBit on the administrative куе “== T haste he believed he used the program for the 
removal of .pst files related to the various exports of CLINTON's email discussed above from the 
administrative server. He took this action of his own accord based on his normal practices as an engineer. 
He did not recall which settings he used, to include the overwrite free space feature. [ — — later 
stated he might have used BleachBit on the Microsoft Exchange server because any .pst exports would be 
created there, then moved over to the administrative server and opened to verify the exported pst file 
worked correctly. 


(u/FegeyL —— ]does not recall who or when the conversation occurred, but someone 
from CESC told him at some point s/he did not want the .pst files hanging around and wanted them off of 
the Server after the export. 


(U//FOUO) After reviewing a text document with the first line “June of 2013," 
stated he did not recall creating the document. However, the statement “PST Files were shredded” is 
probably a reference to his use of BleachBit. 


U//FOGU9) After reviewing log files from the administrative server dated January – October 
2015, stated the reference to Google Apps Sync on April 4, 2015 was possibly an automatic 
update to the software. 


(шко After reviewing ап email dated April 24, 2015 with the subject line [__]4/27-5/1,” 
stated the entry on April 27, 2015 was a calendar appointment related to regular 
maintenance of the Server and associated equipment. 


U/FOUO) After reviewing an email dated August 18, 2015 with the subject “RE: email,” 


stated CESC wanted to verify they had a 60 day retention policy. He believed 
misspoke мес раа оп а 30 day retention policy. 


(U//FOUO) After reviewing an email dated August 21, 2015 with the subject line "RE: Datto 
remote access,” and an email dated August 20, 2015 with the subject line “RE: CESC Datto,” 
stated PRN might have received a new Datto server because in the initial setup of the 
original Datto server, it auto synced with the Datto data center and created an offsite copy. The new 
Datto server would not allow that to happen. 
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(U//F899) After reviewing logs dated September 21-September 26, 2015 from the Microsoft 
Exchange server and September 25-October 2, 2015 from the administrative server, 
speculated he may have removed mailboxes attached to Outlook on the administrative server. He was not 
instructed to delete any user mailboxes on the Microsoft Exchange server in September 2015, nor did he 
delete any mailboxes. Furhermore[ Jeia not do any work with any email exports in the 
September 2015 timeframe. It was standard practice ^ ---— M install OnTrack PowerControls 
on a server because it is required to restore a system from a Datto backup. Additionally, 
would login to the Datto server during regular maintenance appointments to check the backups. 
Regarding the October visits to the CESC Datto Control Panel referenced in the ol талаана ё 

puse е logged into the Datto server using ScreenConnect to verify it was running 

properly. ScreenConnect wa: primary method of connecting to the administrative server. 


(оженө)[ шч not recall manually running a disk defragmenting utility, but would 
sometimes do it as part of routine maintenance. 


(О/#ӨЫӨ) СМ shown several other documents for which he had по information. 
All documents used during the interview are attached to this communication as a 1A. 
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U/FOUO) Оп May3,2016. — мапе River Networks (PRN), date of birth 
— e interviewed by Federal Bureau of Investigation (FBI) Special Agent бА] 
апа р the United States Attorney's Office for ће Eastern District of 
Virginia located at 2100 Jamieson Avenue, Alexandria, VA 22314. Also present for the interview were 
Supervisory Special Agent Information Technology Specialist/Forensic Examiner 
Department of Justice (DOJ) Attorne DOJ Attorne 
as well as 
After being advised of the identity of 
provided the following 


the interviewing agents and the nature of the interview, 


(U/FO8O) In February 2014[ — ]worked with MONICA HANLEY to import an 
archive of HILLARY CLINTON's email from an Apple MacBook to the PRN-maintained server hosted 
for the CLINTON EXECUTIVE SERVICES CORPORATION (CESC), This server hosted CLINTON's 
email account. HANLEY ю{ ]the MacBook contained old email that only existed on the 
laptop and HANLEY did not want to lose it. The email was stored in Mac Mail within folders labeled by 
year as 2009 Inbox, 2009 Sent Items, 2010 Inbox, 2010 Sent Items, etc. LL fried to effect the 
transfer of the archived email through a remote session using ScreenConnect, but the WiFi connection 
was intermittent and the MacBook repeatedly turned itself off. Therefore, HANLEY shipped the 
MacBook "px DEpE ^ unaware of a USB flash drive containing an identical set 
of the email files 


umeua red various tools and Googled for solutions to effectively transfer the 
email files. After researching o; по а of the email content to ће “dummy” 
gmail oe! mpra 177771 com, connected the administrative server to 
the gmail account and used it as a bridge to move the email into a mailbox named hrcarchive on the 
Exchange server. The PRN architecture consisted of a BlackBerry Enterprise server, domain controller, 
administrative server, and Microsoft Exchange server (PRN server). After the transfer was complete, he 
deleted the content from the gmail account and provided the hrcarchive login credentials to HANLEY or 
ind demonstrated how to access the mailbox using Outlook Web Access. 
did not know itl Jo HANLEY provided the credentials to others; however, 
anyone with the credentials could access the account. Prior to shipping back the MacBook, either 


Investigation on __05/03/2016 at Alexandria. VA 
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HANLEY off requested the email be deleted from the Мао int the 
files containing the email, but did not use any special tools to remove the files provided b6 
an address for the return shipment of the MacBook and| used either the United States Postal bic 
Service or United Parcel Service. 
all had access to the prnadmin account credentials to access the PRN server. The 
account on the server maintained by BRYAN PAGLIANO was created by PAGLIANO 
during the transition to the PRN server. There was also a built-in administrator account on the PRN 
м à bé 
server, bu[ ________] never used it. handled most day-to-day work tickets for ътс 
CLINTON 's account, while| andled the physical infrastructure setup and maintenance. 
was authorized to work on the account and served as а баски ^ E, 
however, he only handled a few work tickets. eft PRN in June or July 2015 and, 
based on PRN's normal business practice, passwords were changed for all admin accounts 
(ОУУ) In July 2014, CHERYL MILLS emailed[ — [о schedule a phone call, On 
the call, MILLS outlined ф фе needed an export of al] CLINTON' s email sent to or 
received from a .gov email address (July Export) for the purpose of di ~ them to the United States 
Department of State (State). perdet ** gov" in thi; live “H” 1ailbox to find email 
responsive to MILLS' request. After preparing the export, worked with MILLS and ^ 
HEATHER SAMUELSON to transfer the export to each of their v orkstations. This interaction was the 
first with MILLS. previously interacted with} and 
MILLS served as the primary contact from whic! took direction for 
this export and later exports. hae interacted with SAMUELSON once or twice beyond 
troubleshooting her access to the exports. He described MILLS and SAMUELSON as proficient 
computer users with knowledge of basic programs. 
(U//FO3O) Based on the direction provided by MILLS as described above, ©з 


prepared an export of CLINTON's email from her live account on the PRN server. then 
used 7-Zip to compress the export and password-protect it. To transfer the export to MILLS and 
SAMUELSON, he connected to each of their workstations remotely using ScreenConnect and installed 7- 
Zip. On SAMUELSON!'s laptop he also installed Outlook 2013 because she did not have Outlook at that 
time. After the installation of 7-Zip on both workstations and Outlook 2013 on SAMUELSON's 
workstation — Jtransferred the zip file using Secure File Transfer Protocol (SFTP), unzipped 
the export, and opened the export in Outlook by navigating to it using File->Open->Outlook Data File. 
When transferring the [Т fiey dropped it on the desktop or in a folder on the C: drive 


(U//FOGU9) In September 2014, MILLS contact: nd requested an export of b6 
CLINTON 's entire mailbox (September Export), so} followed a similar process to the July 576 
Export. He prepared а .pst file, zipped it using 7-Zip, and transferred it to MILLS апа SAMUELSON 
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through ScreenConnect. In the preparation of this export sd discussed different options for 
the transfer based on the size of the file, but ultimately decided on the same process using ScreenConnect 
as the July Export. MILLS never requested assistance fom[ ^ ра locating CLINTON's email 
from January 2009 — March 2009 mde ^ 5 never aware there was a gap during that 
timeframe 


(U//FO899) С Faia not know му the jo. file provided to the FBI from CLINTON's 


counsel contained the email address gmail.com in the metadata because he 
believed he created email exports from CLINTON's live email mailbox. However, he provided the 
following possible explanations 


* Cray have imported HRC Archive into CLINTON 's live mailbox 

• А user may have moved email from HRC Archive into CLINTON 's live mailbox. 

e Auser may have taken email directly from the HRC Archive mailbox to produce what was 
provided to State. [.—  ]did not assist in the production of any .pst files provided to State. 


(U//FOUO) During the July Export and September Expot[ — transferred one .pst file, 
contained within a zip file, to MILLS and one to SAMUELSON. Their laptops were running either 
Windows 7 or Windows 8 


f= ee After reviewing a chart labeled “PST files and Outlook Profiles - Admin Server,” 
stated “HRC ооу email Archive.pst,” “HRC .gov emails.pst,” and “HRC gov emails. pst” 


reference the July Exports ШЕШЕН?” the other files as: 


• “HRC archive — complete.pst” references the September Export. 

* “hrearchive@clintonemail.com - HRC archive.ost” is a remnant of the transfer of files from the 
HANLEY laptop described above to gmail. 

*[ gmailcom {+ 1 іетрре | Теоша not recall creating 
this .pst file. 

e “huma-gmail-yahoo.pst” was a result о importing HUMA ABEDIN's email from 
those services to the PRN server. 
U//FOUO) After reviewing a PRN invoice referencing an October I, 2014 call with MILLS, 

— stated the call was in relation to one of the pst file transfers 


SAMUELSON, stated he worked with SAMUELSON to reconnect her to CLINTON's 
email archive. 


(U//FGUO) After reviewing a PRN work ticket dated November 18, 2014 referencing а call with 
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E After reviewing an email dated November 24, 2014 with the subject line “MMM,” 


export requirements," 


stated he did not know what the reference to an urgent call was about b6 
ътс 


(Ш/ ӨНӨ) After reviewing a work ticket dated November 24, 2014 referencing “more specific 
[Dd he did not know what the more specific export requirements 


were, but did not believe an additional .pst file was transferred. Neither SAMUELSON nor MILLS b6 


requested — — Jessist with searches for emails to/from specific users, emails to/from specific 


b7C 


domains, or create additional exports beyond the July and September Exports. 


(U//F8'8O) In November or December 2014, MILLS vid — ]se did not want the 


exported data on the laptops anymore and requested he securely delete the .p: 


st files previously transferred 
to MILLS' and SAMUELSON's workstations, but did not specifically els he deletion 


software. Based on the request of MILLS| Jrecommended BleachBit, a tool he had used b6 
eh with clients who had financial information on computer equipment being decommissioned. b7C 


escribed BleachBit as a utility that securely deletes files by overwriting data multiple 


times. He could not recall what version he used, but would have downloaded the latest version at the time 


of MILLS' request. Sometime prior to this discussion, MILLS mentioned once CLINTON's emails were 
printed for State, she could put the .pst file on a flash drive and have a master copy. 


ad the 


impression MILLS was referring to all of CLINTON' s emails, not just those provided to State. 


(U/FegO)L —— luseá the same deletion process for the workstations of both MILLS and 


SAMUELSON. He initiated a remote session, typically while on the phone with MILLS or 
SAMUELSON, to each workstation using ScreenConnect and downloaded BleachBit from the Internet, 


then installed the software. He used BleachBit to remove the .pst files by running the shredding function 


as a standard user, not an administrator. The process took a few minutes to complete during which ътс 


did not encounter an error message. С believed he shredded a total of eight 


files — the two zip and two pst files on each laptop from the July and September exports. He did not 


recall: 


С Дава the work tickets reflected the tasks he completed to remove .pst files from the PRN b6 


Altering any settings prior to shredding the .pst files 

Wiping free space 

Selecting artifact clean up 

Verifying the deletion of the files 

Selecting “Shred Settings and Quit” once the process was complete 
Targeting any temporary files 

Uninstalling BleachBit 


(U/FEUO) After reviewing work tickets dated December 12, 2014 and January 5, 2015, 
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server and the workstations of MILLS and SAMUELSON. The requests from MILLS were routine 
customer service, so no one else at PRN was aware of the removal task|[ —  ]completed beyond 
what was written in the work tickets. Since completion, neither MILLS nor anyone else from CESC 
contacted to verify this work was complete. Additionally) | was not contacted 
by anyone to discuss the process he used to remove the files from the workstations. 


(ЧУ ӨНӨ? In March 2015, MILLS contacted Jto discuss CLINTON's email. 
Typically, MILLS would contact]________Jusing the email address| — — gmail.com and setup a 
time to call. MILLS wanted to know what backups of CLINTON's email existed and where those 
backups were located. After discussing the potential for content to exist on the server CLINTON used 
prior to the PRN server, PRN dead ООП travel to the datacenter in Secaucus, NJ to 
power up the old equipment (Predecessor server) and check it for any backups or copies of CLINTON's 
mailbox. en зш at the datacenter and turned on the old equipment ^ 1] 
spoke with| while they both were logged on to the system. Neither the Cisco Network 
Attached Storage (NAS) device nor the external USB hard drive that were part of the architecture for the 
Predecessor server contained backups or other data associated with CLINTON' s email 


(О/ЖӨЪӨ) PRN used a Datto backup appliance to backup the PRN server and i : 
common practice to include the administrative server as part of the Datto b could 
not specifically recall if the administrative server was backed up for CESC had no memory 


of stopping Datto backups of the PRN administrative server on March 8, 2015. Datto recommends 
turning off Windows Volume Shadow Copy service because it can interfere with Datto backups. 


U//FOUO! 


(U//FOUO) After reviewing an email dated March 25, 2015 with the subject line “CESC call” and 
an email dated March 25, 2015 with the subject line "Clintons dr stated he could not 
recall the content of the call or the reference to backups in the email 

(U//FOUO) After reviewing a document titled “Exchange Audit Logs" dated March 25, 2015 and 
March 31, 201 jp the Platte Admin mailbox received firewall alerts and other internal 
tem alerts, Additionally, the Platte Admin account was used to effect changes on other mailboxes. 

re lai not specifically recall using it to provide full access for prnadmin to the mailboxes H, 
HDR29, and HRC Archive on March 25, 2015 and then removing the HRC Archive mailbox from the 
Exchange server. However believed he had an “oh shit” moment and removed the HRC 
Archive mailbox. He also changed the mailbox retention policy from 30 days to 1 day, and cleaned the 
mailbox database because MILLS previously requested in late 2014 or early 2015 he change the retention 
policy for CLINTON and ABEDIN's existing and ongoing email to 60 days. He removed the HRC 
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Archive mailbox manually because all content in the mailbox was older than 60 days. 

changed the deleted items retention policy from 30 days to 1 day to ensure no email outside of the 60 days 
remained on the server and executed the Clean-MailboxDatabase command to clean whitespace within 
the database, similar to running a disk defragmentation | also enabled Circular Logging, but 
did not recall why he did so in this instance. He typically enabled it when importing email because 
Microsoft Exchange logs contain email that hasn't been committed to a database. Circular Logging 
reduces the log file size by forcing Exchange to commit data to the database immediately. 


(U//FOUO) After reviewing documents titled “BleachBit - PRN Admin Server" and “BleachBit — 
Exchange Server" indicating the use of BleachBit on March 31, ааа. he checked the 
Exchange Server for remaining copies of CLINTON's email. When he located a .pst file, he used the 
most recent non-beta version of BleachBit available at the time to shred the .pst files on the PRN server, 
but did not recall which .pst files he found or removed. He did not wipe free space, encountered no 
errors, and_viewed the folders to see if the files were gone, but did not take additional steps to confirm the 
deletions. С еа not talk with MILLS about the files he found and deleted. 


(U//FEUO) After reviewing log files dated March 31, 2015 indicating the deletion of files from 
the Datto backup драп] = Jat he did not recall deleting any Datto backups nor did he 
recall receiving an instruction to delete backups from the Datto, however, it is unlikely anyone else at 
PRN would have deleted the files ананын: not know if the administrative server was backed up 
to the Datto. 


(U/FG98O) After a a document titled “PRN Admin Server – Installed/Uninstalled 


Application Events,” stated he had no insight into the installation of Google Apps Sync for 
Microsoft Outlook on April 5, 2015. 


(U//F8UO) After reviewing documents titled *Add-MailboxPermission and Remove- 
MailboxPermission” and “Export.pst on Admin Server — 9/25/2016 Pio pd ^ in 
September 2015 he looked into replacement options for the PRN server because he believed the server 
would be turned over to the FBI. To prepare for this eventuality, he logged onto the server to verify the 
backups of the server were working correctly and evaluate what new hardware PRN would need to order. 
During the same time deb ра ї{һетаПБох{о[ — — — ] This 
restoration may account for the activity related to Export.pst in September 2015 and it is unlikely 
Export.pst contained any of CLINTON's md e. das. expat pst after the 
restoration was complete. However, he did not delete any data related to CLINTON' s email after he was 
interviewed by the FBI in September 2015. 


(U//FOUO) After reviewing an email dated March 9, 2015 referencing a preservation email from 
DAVID KENDALL and a preservation request from the FBI dated July 31, 201 S[ ава he 
was aware of the preservation requests and interpreted both as meaning he should not disturb CLINTON's 
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эше d 
United States Department of State (DoS), 2201 C Street NW, Washington, D.C. 20520. 


was interviewed by FBI Special 


After being advised of the identity of the interviewing agents and the 
[provided the following information 


office telephone| 
nature of the interview 


Principal Officer Electronic Messaging System (POEMS) was a Top Secret DoS email system that 
was phased out several years ago. Today the term POEMS is often used by people referring to the DoS 
email systems provided by the Office of the Secretary, Office of the Executive Secretariat - Information 
Resource Management (S/ES-IRM). While the majority of DoS employees receive IT support from 
Information Resource Management (IRM), a subset of approximately 600 individuals receive IT support 
from S/ES-IRM. This subset is composed of high-level DoS executives and staff, who are collectively 
referred to as the "7" floor.” The S/ES-IRM system was created to provide the 7" floor users with 
enhanced customer service. 


Despite being administered by separate groups, the IRM and S/ES-IRM systems utilize the same 
hardware and software platforms. Both groups support their respective users across both Opennet, the 
unclassified DoS network, and Classnet, the classified DoS network. The top secret network at DoS is 
operated by the Bureau of Intelligence and Research (INR) regardless of the user. 


S/ES-IRM does not have stand-alone email backup. Historical emails have to be extracted from an 
overall system backup. The volume of available historical emails therefore depends on what each user had 
saved on their system when the system backup occurred. The entire S/ES-IRM system is backed up every 
night during which the email exchange, as well as file servers, shared drives, applications and other 
relevant files are captured. The backup tapes are held for 45 days. S/ES-IRM has pulled the relevant 
S/ES-IRM system backup tapes in response to the preservation requests issued by the FBI and is 
preserving them until they receive further direction from the FBI Реа that 
approximately 100 of the 600 S/ES-IRM customers were listed on the preservation request 


L_Jprovided that the exchange servers are housed at ESOC in Culpeper, VA and that 
the backups are stored at the Harry S. Truman building. 


Investigation оп __ 09/11/2015 at Washington, DC 


ris [ 1] Date dictated — N/A 


S, 
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S/ES-IRM customers do not use the State Messaging and Archival Retrieval Tool (SMART) for 
memorializing official email records. Instead, they follow the “print and file" policy whereby each 
individual is responsible for assessing if a communication should be archived and is then responsible for 
printing and appropriately filing the communication. SMART is primarily used for archiving cable traffic 
and replaced a legacy system known as CableXpress approximately four or five years ago. 


S/ES-IRM does not administer the Public Affairs Communication Electronically (PACE) system, 
which is operated by the Bureau of Diplomacy. PACE is a much smaller system but it is possible that a 
few people from Secretary Clinton's staff may have used PACE. 


DoS does not have a restriction on the use of personal email accounts for official business. 
Personal email accounts are often used by individuals in the field who were not issued an official DoS 
mobile device, or who do not have the time or means to remotely log into the DoS system. Employees are 
not required to notify DoS that they are using a personal account for official business and there is no 
mechanism to track who is using a personal email account. In 2009 and 2014, DoS issued official 
guidance to users of personal email accounts that stipulated that they must forward work-related emails 
back to their official work account within a specified period of time for record keeping purposes. 


S/ES-IRM does not automatically create Opennet or Classnet email accounts for new employees. 
Accounts are only created once a request form has been submitted. S/ES-IRM had no record of a request 
being completed by, or on behalf of, Secretary Clinton for the creation of DoS email accounts. Nor were 
there any records of requests being made for a DoS mobile device. 


S/ES-IRM is also responsible for issuing official cell phones and other mobile devices to their 7% 
floor customers. However, S/ES-IRM does not have historical records for devices issued during Secretary 
Clinton's tenure. The system that was used for tracking property during that time period was previously 
taken offline and S/ES-IRM has been unable to restore the system due to the presence of corrupt files. 
While users were required to sign a property record when a device was issued to them, those records 
would have been destroyed once the device was returned to S/ES-IRM. 


was not able to provide any specific information about the broader IRM system and 
their efforts to preserve relevant data. He recommended contactin: 
ја Ње Bureau of Diplomatic Security (DS 
noted that BRIAN PAGLIANO works fo: 
contacting IRM 


Lena [уеге available for future contact if necessary. 


and care should be taken when 
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(U//FOUO) On January 11, 2016, MONICA HANLEY was interviewed by Federal Bureau of 
Invesisaton (FBI) Special Agenst def] —] 
Washington, DC 20001. Representing HANLEY, and also present for the 
interview, were and After being advised of the identities of the 
interviewing agents, and the purpose of the interview, HANLEY provided the following information: 


(Ц/ ӨНӘ) In 2003, following her college graduation, HANLEY interned for then Senator 
HILLARY CLINTON. HANLEY's internship position was converted to a permanent position in 2004. 
HANLEY continued working for New York Senator KIRSTEN GILLIBRAND, who was appointed after 
CLINTON was nominated as Secretary of State 


(U//FOHO) In April of 2009, HANLEY received a call from HUMA ABEDIN asking if 
HANLEY would be interested in working for CLINTON as a “Confidential Assistant" at the Department 
of State (DoS). HANLEY accepted the position at DoS, and continued working for GILLIBRAND until 
two days before her start at DoS. 


(U//F&8O) During her first year at DoS, HANLEY's “Confidential Assistant" duties included 
supporting and scheduling CLINTON, domestic travel and personal appointments. HANLEY also ran 
various errands for CLINTON. HANLEY also served as ABEDIN and JAKE SULLIVAN's scheduler, 
and it was her responsibility to coordinate their schedules with CLINTON 's schedule. 


(U//F8UO) HANLEY accompanied CLINTON on foreign travel on a few occasions during her 


first year at DoS. HANLEY's first overseas DoS travel with CLINTON was to the Philippines. 
CLINTON specifically invited HANLEY to join her on that trip because CLINTON knew HANLEY was 


of Filipino decent and would appreciate the opportunity to travel there. ABEDIN almost always traveled 
with CLINTON [сн were additional aids who rotated duties 


with HANLEY in regards to accompanying CLINTON on foreign travel. 


(U//F88O) When ABEDIN became pregnant in 2011, HANLEY became a primary traveler and 
accompanied CLINTON on most of her foreign trips. and 
|were also part of CLINTON" vel team during this time. was responsible 


for managing press matters, whereas |were responsible for protocol. 
Unvestpationon, — 1/11/2016 at Washington. D.C. 

Fic [ ^ — pe Daie dictaicd — N/A. 

By & Sal 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency: it 
and its contents are not to be distributed outside your agency. 
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(U//F9UO) HANLEY went through a full day of on board training her first day at DoS, of which 
approximately half was security related. HANLEY recalled learning specifically how to handle and 
transport classified information/paper, but could not recall who provided the training. HANLEY received 
a Top Secret/SCI clearance at DoS, but was unsure of any specific codeword programs for which she may 
have additionally received read-ins. HANLEY did not hold a security clearance prior to DoS 


(П// ӨНӨ) HANLEY did not recall ever receiving Freedom of Information Act (FOIA) training, 
and the only training HANLEY received concerning the Federal Records Act (FRA) came near the end of 
CLINTON's tenure at DoS. A representative from DoS' s record keeping К ma] г Name 
Unknown (LNU), met with HANLEY and others on CLINTON's staff and instructed them to produce all 
records that “changed, effected, or created policy.” HANLEY recalled going through paper files with 
other executive Staff members, and placing the papers in stacks in the hallway outside the Secretary' s 
Suite, After which, a DoS record keeper would review the production and make the final determination 
on which information was relevant to the FRA 


Email Accounts and Server 


(U//FOUO) During her time in the Senate, CLINTON used hri S@ait. blackberry net, HANLEY 


was aware of this email account, but did not use this account to communicate with CLINTON. 


U//FO8O) CLINTON used hr: ntonemail.com while she was Secretary of State, and 
: following her departure from DoS. 


the interview HANLEY deduced th мт com account may have been created asa way to 
comm nicate with CLINTON during a bad storm in 2011 when power to the server hosting 

і was lost. HANLEY believed CLINTON was traveling in Croatia at the time, 
and HANLEY and| may have created the account as a temporary way to communicate 
with CLINTON during the outage 


(U//FGU9) HANLEY did not Ed recall the ассо gr , however, later in 


(U//FBU8O) HANLEY was not familiar with the email address SSHRC @state. gov. HANLEY 
vaguely recalled CLINTON being issued a DoS Blackberry, but CLINTON did not use the DoS issued 
device. 


(U//FO8O) HANLEY was aware CLINTON was using a personal email address on a personal 
server for DoS business while CLINTON was Secretary of State. JUSTIN COOPER created, installed, 
and maintained the server in Chappaqua before the server was transitioned over to Platte River Networks 
(PRN). HANLEY could not recall when the transition to PRN occurred. COOPER was HANLEY's 
point of contact for assistance in regards to syncing CLINTON's mobile devices to the server. Anytime 
CLINTON got a new device, HANLEY would contact COOPER who would troubleshoot her through the 
process of setting up the new device with the server. COOPER was also HANLEY's point of contact 
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when needed reimbursment for items she purchased for CLINTON. COOPER was located in New York, 
so most of HANLEY's interaction with him was via email or telephone. 


(U//FG8O) BRYAN PAGLIANO was part of CLINTON's 2008 Presidential Campaign and was 
later employed by DoS in a technical capacity. HANLEY would contact PAGLIANO for help with 
physical Blackberry problems. 


(U//FG89) HANLEY did not recall ever participating in, or overhearing, any discussion over 
records retention issues, nor the legality of CLINTON conducting DoS business off a private server or 
email account 


(О// ӨНӨ) HANLEY was asked to review a few emails forwarded from CLINTON at 
hrod? 7@elintonemai! сот to HANLEY's DoS email account wherein CLINTON asks HANLEY to print 
the forwarded email. After reviewing the email, HANLEY explained CLINTON did not like reading 
things on her Blackberry because it was difficult to read the small font, so she preferred a hard copy for 
longer emails. Sometimes CLINTON would keep the hard copy to archive the document, but HANLEY 
was not privy to what documents CLINTON had printed for an easier read versus archiving. 


U//FOUO) HANLEY used two email accounts while at DoS: |, y and 
28% nail.com. HANLEY did not have an @clintonemail.com email account, nor was she 
ever offered an @clintonemail.com account. As a way of general practice, HANLEY tried her best to use 
her state.gov email account for work related matters and her Gmail account for personal interactions with 
CLINTON. HANLEY further explained she considered personal interactions with CLINTON to include 
things like scheduling hair appointments. However, HANLEY noted that her state.gov email account was 
not as easily accessible as her Gmail account and on some occasions she use Gmail when she could not 
access her state.gov account. 


(U//FGU9) HANLEY was issued and carried/used a DoS Blackberry. It was difficult to access 
DoS email while on travel, as the DoS system required users to sign in using a token/key to sign in 
remotely, It was particularly difficult to sign into the DoS system in the Secretary's plane because the 
wifi was not always compatible, so HANLEY would often use her Gmail account while in the air. The 
same was true for foreign travel. Many DoS employees used personal email accounts because they were 
more easily accessible. ABEDIN emailed HANLEY equally from her state.gov and personal accounts. 


Mobile Devices 


(U//FGUO) After she reviewed pictures of various Blackberry models, HANLEY pointed to the 
picture of the Curve 8310 explained CLINTON preferred the Curve 8310 because she found the 8310 
“track-ball” feature easier than the “track-pad” on newer Blackberry models. CLINTON tried the 
Blackberry 8700G, but did not like the device because of the “track-pad.” HANLEY also thought the 
Curve 8900 looked familiar. HANLEY did not recall the specific Blackberry devices CLINTON used at 
DoS, but believed CLINTON's original Blackberry was black in color and housed in a blue silicone case. 
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(U//FOUO) HANLEY recalled helping CLINTON change her Blackberry device at least three or 
four times while she was at DoS. HANLEY recalled having to replace CLINTON 's Blackberry on one 
occasion after CLINTON spilled coffee on the device. Another time HANLEY recalled having to replace 
CLINTON's Blackberry because it started to slowly fail overtime. HANLEY recalled proactively trying 
to purchase replacement Blackberrys for CLINTON at one point, but CLINTON only liked the older 
models. HANLEY believed she may have even purchased one of the older Blackberry models CLINTON 
liked off of Ebay 


(U/FOYO) HANLEY would contact COOPER after purchasing a new Blackberry device for 
CLINTON, and he would instruct HANLEY as to how to connect the device and sync the device with 
CLINTON's server and email. Once the new device was properly synced, COOPER would also talk 
HANLEY through the process of wiping the old device. HANLEY would provide the new Blackberry to 
CLINTON along with the old/wiped Blackberry. However, HANLEY was not sure what CLINTON did 
with the old Blackberry after HANLEY turned them over. 


(U//FOUO) Aside from receiving emails on her Blackberry, CLINTON used her Blackberry to 
text and pin short personal messages 


(U//F9UO) CLINTON also used an iPad. HANLEY could not recall when CLINTON obtained 
the iPad, but thought it may have been purchased by COOPER. HANLEY was not sure who configured 
CLINTON's iPad. CLINTON predominately used the iPad in the evenings and while on travel (both 
domestic and international) for reading news articles and emails. CLINTON did use the iPad to send and 
receive emails. CLINTON did not use the iPad while she was in her office at DoS 


(ЦШ/# ӨНӨ») ABEDIN, HANLEY, and| һа access to CLINTON's iPad on occasion to 
assist CLINTON if her iPad was not working properly, but HANLEY could not recall CLINTON giving 
her iPad to anybody else to use. 


(U//FO9O) CLINTON received a new iPad in 2011 and gave HANLEY an iPad around the same 
time. HANLEY assumed CLINTON gifted her with CLINTON's old iPad. Agents asked HANLEY to 
review an email exchange dated 8/18/2011 between ABEDIN and COOPER in which ABEDIN tells 
COOPER “She [presumably CLINTON] doesn't like ipad 2..." and later typed "She gave to monica as a 
birthday gift." After reviewing the email, HANLEY explained that she assumed she received CLINTON's 
old iPad, but now realizes she likely received CLINTON's newer iPad. HANLEY was not aware the iPad 
was a birthday gift, but stated that it was not uncommon for CLINTON to gift ABEDIN and HANLEY 
with some of her personal items she no longer wanted. 


(U//FGUO) When HANLEY received the iPad the opening screen said “H's iPad,” so before 
using the gifted iPad, HANLEY wiped the device. HANLEY used the iPad for personal use up until the 
time she moved back to New York in 2014. Prior to moving, HANLEY gave the iPad Wc 
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eee ee el so he could use the iPad to listen to music and podcasts. HANLEY did not 


wipe the iPad prior to gifting it t 


(U//F8'89) In October of 2013, HANLEY received a call from CHERYL MILLS who inquired 
about the iPad. HANLEY explained she received what she believed was CLINTON's old iPad as a gift 
from CLINTON in 2011. MILLS subsequently informe she needed to turn over the iPad in 
response to the FBI's investigation. HANLEY send pb retrieve the iPad and turned it over. 


Laptop Computer 


(U//F9UO) After they learned longtime friend of CLINTON, SIDNEY BLUMENTHAL, was the 
target of an email hack in Spring of 2013, PRN spoke with COOPER, ABEDIN, and HANLEY, and 
advised CLINTON change email addresses. CLINTON did not want to lose her old emails when she 
changed her email address. COOPER subsequently provided HANLEY an extra Apple Macbook from 
President Clinton's Harlem, NY, Office. HANLEY then transferred all of CLINTON's old emails from 
the PRN server to the Macbook Air. HANLEY transferred the emails to the Macbook in hei 

apartment, and noted that it took several days because she transferred four years of emails. 
HANLEY also recalled transferring the emails to a thumb-drive, but could not recall what happened to the 
thumb-drive. 


(Ц/ ӨНӨ) HANLEY maintained possession of the Macbook following the transfer of the emails. 
The Macbook was stored in HANLEY's apartment. HANLEY moved at least once after she transferred 
the emails to the Macbook, and brought the Macbook with her to her new apartment. 


(U/A HANLEY contin work for CLINTON following DoS, and in early 2014 took a 
position in th Shortly thereafter, HANLEY realized she still 
had possession of the Macbook containing CLINTON's archived emails. HANLEY subsequentl 
contacted PRN on her own accord and spoke with р ea] 
HANELY shipped the Macbook to n in February and instructed PRN to 


migrate the emails back to CLINTON's existing server, wipe the Macbook, and return the Macbook to 
И ^ was CLINTON' at the time. 


Ш/А The Macbook was shopped fro 


to ask about the whereabouts of the Macbook. 


(U//FOUO) When HANLEY was first contacted by FBI agents in November 2015 in regards 
scheduling an interview, she reached out Оран 
ee HANLEY she did not recall receiving the Macbook from PRN. 


= HRC-92 


b6 
b7C 


b6 
ъ7с 


b6 
b7C 


b6 
ътс 


b6 
ъ7с 


b6 
ъ7с 


FD-302a (Rev. 10-6-95) 


Continuation of FD-302 оѓ Interview of Monica Напісу . On 1/11/2016 , Page 6 


Handling of Classified Material 


(U//F889) CLINTON did not have a classified DoS account, and received all classified 
information in paper form. CLINTON's Executive Assistant, JOE McMANUS, was responsible for 
determining what classified information needed to be passed up to CLINTON. The Central Intelligence 
Agency (CIA) Presidential Daily Briefer (PDB) on occasion may have also flagged information for 
CLINTON to read. When CLINTON was on travel, her traveling Executive Assistant or SULLIVAN 
would determine what classified information needed CLINTON 's attention. 


(U//FG9O) HANLEY visited both CLINTON's Chappaqua, NY, and Washington, DC, ie 
residences, however, HANLEY spent more time in CLINTON' s Washington, DC, home. HANLEY b7c 
believed CLINTON had a Sensitive Information Compartmented Facility (SCIF) installed on| 
floor of her Chappaqua home that contained at least a secure phone and fax. CLINTON also had a SCIF 
in her DC home. HANLEY believed the DC SCIF contained a secure phone and unclassified Mac 
desktop, but was not sure about a fax machine. 


(U//EQUO) When the DoS Operations Center needed to get classified material to CLINTON at 


her DC residence, the information would be couriered by her security detail in a diplomatic pouch. Only os 
a few people close to CLINTON, such as HANLEY could deliv: i ic pouch directly to her. 
HANLEY assumed CLINTON' {din Chappaqua, ‘ould also accept and 


deliver diplomatic pouches 


(U//FO8'89) A DoS Mobile Communications Team (MCT) traveled with CLINTON on both 
international and domestic trips. The MCT was responsible for setting up a command post for bl per DOS 


CLINTON's team. Depending on the security climate at the destination, the mobile command post would 
E : = = Or = е2 = = СЕ generally set up an unc m: 


DoS computer in either ABEDIN or HANLEY's room for the purpose of printing unclassified 
information for CLINTON. It was not uncommon for HANLEY to use her personal Gmail account to 
print from the mobile DoS unclassified terminal because even though she was using a DoS computer, the 
DoS connection was unreliable. 


(U//F8UO) CLINTON had a secure phone in her office at DoS, as well as in both her 
Washington, DC, and Chappaqua, NY, residences. When CLINTON was traveling, ABEDIN would 
generally carry a secure cell phone. HANLEY carried the secure phone on occasion, and described the 
phone as looking like an old Nokia non-flip phone with a big antenna and large buttons. The secure cell 
phone was carried in a box. ABEDIN kept a secure cell phone in her desk at DoS. 


(U//FGUO) HANLEY received a lesson from somebody on the DoS technical team in regards to 


using the secure cell phone, but when HANLEY tried to use the secure cell phone in 2012 on a trip to 
Haiti, it did not work 
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Email Review 


(U//F8UO) HANLEY was contacted by CLINTON's attorney, DAVID KENDALL (Williams & 
Connolly), in March or April of 2015. Following her conversation with KENDALL, HANLEY searched 
the Gmail account she used while at DoS for any email communications with state.gov accounts and 
deleted emails associated with state.gov accounts. HANLEY was not involved with any efforts to review 
and cull CLINTON's emails 


General Security Matters 


(U//FOUO9) HANLEY never personally was notified of an intrusion attempt against any of her 
email accounts (personal or Gmail), however, she remembered hearing some state email accounts were 
hacked by presumably the Chinese Government following one of CLINTON's trips to China. 


(U//F9U9) HANLEY also received verbal security counseling from Diplomatic Security (DS) 
following a Russia trip on which she accompanied CLINTON. HANLEY was handed a diplomatic pouch 
containing CLINTON 's briefing book on the plane upon arriving in Russia. HANLEY brought the pouch 
and its contents into the Russian hotel suite she shared with CLINTON. DS found a classified document 
from the briefing book in the suite during a sweep following CLINTON and HANLEY's departure, and 
HANLEY was later informed by DS the briefing book and document should never have been in the suite. 


(О/ЕӨЪЮ) A copy of the original interview notes are attached in a 1A envelope. 


HRC-94 


= ALL FBI INFORMATION 
FD-302a (Rev. 10-6-95) HEREIN IS UNCLASS 
-1- САТЕ 08-13-2015 BY 


FEDERAL BUREAU OF INVESTIGATION 


CONTAINED 
D 


385794 NSICC 


Daic of transeription | 11/13/2015. 


«u/eeseyL Jws interviewed at his office at the Harry S. Truman Building, 
2201 C Street NW, Washington, D.C, by Federal Bureau of Investigation (FBI) Special Agents (SA) 
[Lend After being advised of the identity of the interviewing agents, 
and the nature of the interview, rovided the following information: 

(U//FGUO) In February 2009[ —— Мә assigned as {iin the Department of State 


(DoS) Operational Center, DoS's Operational Center is manned 24 hours a day by three different watch 
shifts. Sometime in 2009| ^ became a which meant tha: 


(О/ЕӘНӘ) In his role as CLINTON's| was responsible for reviewing 
and filtering information intended for CLINTON reviewed various reports and 


information/action memos to determine which warranted forwarding to CLINTON, and would 
subsequently filter out and clean up the most relevant information to forward to CLINTON via her 
Executive Secretary, JOSEPH MACMANUS. The report| — reviewed were a "mixed bag," and 
included everything from unclassified ceremony notifications and Talking Points, to Secret and Top 
Secret intelligence briefings. 


(U//F8U9) CLINTON did not have a computer in her office, nor any electronice мав 
aware of, so all briefing materials forwarded for CLINTON's review in office were provided in paper 
form as responsible for making sure he properly organized and marked the reports he 
forwarded in regards to their classification. 


Investigation оп — 11/13/2015 at Washington, D.C. 
Fic # LL de Date dictated — N/A 
By S SA 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency: it 
and its contents are not to be distributed outside your agency. 
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(U/-FOY8) There was no specific guidance as to what information 


expected to forward up to t| 
quickly got a sense of what 


„ On 11/13/2013 . Page 2 


were 
е Secretary's attention, nitially ran things by MACMANUS, but 
information needed to be pushed up the chain. 


(U//F8GHO) CLINTON had an Advance Staff of twelve to fifteen people, referred to as “The 
Line," who would serve as CLINTON's Special Assistants while she was on travel. When CLINTON 


was traveling, wou! 
classified systems. ALICE 
Secretary. 


would have been “weird” for him to send CLINTON an email. The only time 


d communicate with “The Line” and MACMANUS via both unclassified and 
WELLS eventually replaced MACMANUS as CLINTON's Executive 


thought he may 


(U//eeue] did not recall ever emailing CLINTON directly, and C hos stated that it 


have emailed CLINTON directly would have been during the Royal Wedding. I 


needed to push 


information up to the Secretary via email, he would reach out to either MACMANUS or her Chief of 
Staffs, HUMA ABEDIN and JAKE SULLIVAN. 


(U/FO8O 
rule as the Deputy Chief о 
very late at night. ABEDI 


described SULLIVAN as a “work-a-holic,” and explained he served in the 
Staff (COS) for Policy. It would not e uncommon for SULLIVAN to work 
served in the role of Deputy COS for Operations, and was more concerned 


with logistics related to CL 


NTON' s travel. 


queese| ]was unaware that CLINTON was working off of a n server. L 


only received a few emails directly from CLINTON, which appeared from “Н” 


though: 
little odd because the DoS email naming convention was usually last name, first name, о] 


did not recall checking the actual email address. 


ssumed CLINTON' s email was regulated by 


DoS, as she had a DoS Blackberry. 


(ШЕ ӨБӨ 
recalled 
remember receiving similar 


was assigned to| from 2012-2013, and 
being very specific about the process for record emails. did not 


guidance conceming records emails at DoS. Because of the banner 


information on DoS computer systems[ — Jassumed that all of his DoS emails were for the record. 


wrese[  ] 


is a user of the DoS POEMS system. ]recatted periodically pu 


notification from the systems administrators concerning attempted hacks to the POEMS system 
could not recall the specifics or the timing of these notifications. 


(U//F8U9) Interviewing agents азке hto review an email sent from[ ——— dated 
4/10/201, and titled "Stevens Update (Important)," as publically available online in the DoS Reading 
Room. The email was addressed to SULLIVAN, ABEDIN, WELLS, and S SpeiAsssans| — —] 
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stated he was familiar with the email and was aware that it was recently released as part of a recent 
Freedom of Information Act (FOIA) request concerning CLINTON' s emails 


(U//FO9U9) The email in question originated as an unclassified email from the DoS Operations 
Center ө] who stripped the preceding trail of emails and possibly fixed a few g ical and 
spelling errors before forwarding the email on to SULLIVAN, ABEDIN, and WELLS [ned that 
he likely also added “(Important)” in the Subject line of the email, but did not make any substantive 
changes to the email before forwarding it. The email would have initially come M iom a specific 
person in the Operations Center, However, id not recall who specifically in the Operations 
Center sent that particular emal[ — kid not have a record of the email he received from the 
Operations Center, but stated that the Operations Center does maintain all records. MCMANUS and/or 

р be individuals with access to the Operations Center records. 


uewe l pia not push forward all information he ived from the Operations Center. 
However, he would orally brief information more often than email d not recall an instance 

where he was concerned with the Operations Center moving classified information from the high side to 
the low side. 


(U//F8U9) The majority of the personnel in the Operations Center are Civil Service employees 
who receive extensive structured training before they are on their own on the *Ops Floor." The 
Operations Center receives information from all over the Intelligence Community (IC). One person on 
each watch shift is tasked with the *watch fax," which receives reports from all over the IC. 


(u/rege| further stated that he thought the "discussion over (the aforementioned) email 


was healthy, and thinks that there is likely a problem with the way DoS gathers and uses information” 
from the IC 
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n Ц 
States Department of $ au of Administration [en a Se fl ashington, D.C. 
20520, DN te telephong i HM 
date of birth in person by FBI Special A 
E. FBI Headquarters, 935 Pennsylvania Avenue Northwest, Washington, D 0 
е 


тїр, advised of the identities of the interviewing Agents and the nature of the interview 
provided the following information 


a dC, 
2015. Tnitially, officials were told there were 14 bankers boxes of former Secretary of State Hillary ртс 


CLINTON's emails at CLINTON's Friendship Heights office. Later, officials were told that the boxes 
would be picked up from Williams & Connolly, LLP. On or about December 5, 201 nel 
picked up only 12 bankers boxes of CLINTON' s emails from Williams & Connolly. Lum 
other IPS officials were not sure if the boxes were consolidated or what could have happened to the two 
other boxes. The boxes were label i anges, which were accurate for the most part. Some of the 
documents were filed out of ore] ota the documents were pre-arranged differently than 
one would expect if the documents were simply printed out and then stacked into the boxes. IPS 


personnel provided copies of the documents to STATE's Bureau of Legislative Affairs, Office of the 
Legal Adviser, and the Office of Congressional and Public Affairs 


Although, CLINTON was sworn in as Secretary of State in January 2009, IPS officials were 


unable to er emails from January-April 2009 in the documents provided by Williams & 
Connolly. id not know whether CLINTON used a different email address at that time. dt 
A preliminary review of the documents did not occur until months later. IPS had to wait on the Office of 
Legal Counsel to provide an official determination as to whether the emails would be considered official 
STATE records. At some point, the determination was made that the emails would not be considered 
official STATE records 
bé 

Based on the dates on the on ы the box with the Benghazi-related incidents ътс 
first. There were sensitive Benghazi-related records, some тес ional Archives and 
Records ini i ind some personal emails in that rds and 
jor ppm К the records appraisal. nformed| here were 
some potential classified emails, including some from Sidney BLUMENTHAL, that appeared to have 
Investigation оп — 08/17/2015 at Washington, DC 
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been written by Tyler Drumheller, former Central Intelligence Agency (CIA) Division Chief, European 
as well as other emails that discussed various information 


related to various foreign governments 


Sometime around late January 201 L have a status brief about the emails to STATE 

officials Patrick KENNEDY, Under Secretary for Management, 

Bureau of Administration, lobal Information 

Services ere each provided with two binders full of email ex: 

venus inal were possibly classified. [puse her binders mm] but 
е 


KENNEDY decided to keep his binders following the bri 
[ШШШ not aware of anyone in IPS or at STATE who received the rules or parameters the 
CLIN team and/or Williams & Connolly used to segregate CLINTON' s personal and official work 
i ‘oximately 60,000 emails, which were reduced to about 30,000. IPS had requested 
[Legal Adviser, STATE to ask Williams & Connolly for the rules they used. 


To dxe[ [ш not believe] __feccived a response, 


STATE Inspector General, was also trying to determine how Williams & Connolly performed their 
review and what basis they used in reducing the emails. Initially, Cheryl MILLS, former CLINTON 
Counselor and Chief of Staff, was the only CLINTON staff member to respond to a formal request by 
STATE for information pertaining to personal email and devices used to conduct official STATE 
business. 


According to L h February 2015, 
attorneys at STATE' s Office of Congressional Affairs since approximately] ап 
p ei] along with attorneys from the Office of Legislative Affairs, 
performed their review of the 30,000 emails, from which 296 emails were located and produced 


responsive to requests from the U.S. House of Representatives Select Committee on Benghazi. The 
manual paper search was done using keywords “Libya,” “Benghazi,” and “security.” 


Prior to OIA review by IPS of the 296 emails, Congress threatened to release the 296 
emails based ap that her team had аге; inated with the appropriate STATE 
bureaus and inter-agency reviewing officials. H land her team did not work with the 
regular interagency reviewers familiar t 


Management Division, FBI. L=] i ay have coordinated with DOJ, but not with 
the FBI 


In or around March and i d IPS felt pressure by both Congress and 
internally from KENNEDY and| to quickly approve the 296 emails for release. Initially, 
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nd his team were told to do a “light review with light redactions,” but were later told by the 
Office of Legal Counsel to perform a regular FOIA review. [eee = hea team of senior 
reviewers, approximately 40 full-time equivalent reviewers, worked with the appropriate Bureaus on 
possible classified information and sent the proper referrals to the United States Intelligence Community 
(USIC) partners 


C þa not hin þa the Office of Legislative Affairs attomeys had the 


appropriate training and experience to review, redact and produce emails responsive to ши" 


inquiries and especially not expert enough to respond to FOIA requests. For starters} ind her 
team performed their entire review, redacted what they did, and then copied the 296 Emails To a .pdf file 
on an unclassified network. If any information was later found to be classified, then they would have not 
only corrupted every computer that touched that classified information, but they might have contributed to 
a loss of classified data. IPS always pushed their material to the SIPRNET network and used their "F2" 
enclave to perform their FOIA review before disseminating their products. Also, the 296 emails provided 
s a раё included redactions done for CLINTON's privacy but unrelated to national security. 


ч there was interference with the formal FOIA review process. Specifically, 
STATE's Near East Affai u upgraded several of CLINTON's emails to a classified level with a 
B(1) release exemption, long with attorney, Office of Legal Counsel called 


STATE's Near East Affairs Bureau and told them they could use a B(5) exemption on an upgraded email 
to protect it instead of the B(1) exemption. However, the use of the B(5) exemption, which is usually 
used for executive privilege-related information, was incorrect as the information actually was classified 
and related to national security, which would be a B(1) exemption 


Department of Justice (DOJ), and , that she had coordinated the 
review of the 296 emails with the appropriate STATE bureaus and inter-agencies. The emails “were 

viewed and there was nothing classified in them, so the FOIA review should go quickly.” 
mua unsure why the FOIA review was taking so long. 


again stressed þreview and coordination were done with people unfamiliar 
to nd меј normal points of contact that IPS used for other agencies. More 
importantly, although ап ‘thought their quick initial review showed none of the 296 
emails were sensitiv; 2 the A review, one document had been upgraded to classified 
based on input from nd [There were other documents IPS recommended for 
upgrade, including one specifically related to the Department of Defense' s United States Central 
Command (CENTCOM), and others that were still in the referral stage, including emails that have FBI 
and CIA equities involved that originated from BLUMENTHAL. 
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id not know why he and IPS were not part of the initial Cong iew for the b6 
296 Benghazi-related emails, like they had been for past Congressional inquiries. as cut out b7C 
of the loop for the materials i bs] Congress and had no idea what kind of revie and 


her team performed. land seemed to have been placed in their specific positions by top 
STATE officials; they appeared to have a very narrow focus on all CLINTON-related items, and were put 
in positions that were not advertised. 


In early May 2015, KENNEDY called an interagency meeting regarding the scheduled release of 
all the CLINTON-related emails by the January 15, 2016 deadline and asked for quick turnarounds on any 
future requests. People in attendance include epresentatives from White House Counsel, b6 
CIA, FBI, Office of the Secretary of Defense (OSD), Director of National Intelligence (DNI) and the 576 


National Security Council (NSC) 
ing, KENNEDY held a closed-door meeting | MEM ore 
DOJ' s Office of Information Programs where 


I's classification determination regarding one of CLINTON's 
considered classified. The email was related to FBI counter-terrorism operations. 


рена calle NEN on one occasion. The purpose of that call was to ask I 
uestions regarding pressure from the Office of the Inspector General of the Intelligence 
ommunity (ICIG) to complete the review of the approximately 30,000 emails. Specifically, KENNEDY 

wanted ti € was precedent to have outside reviewers help STATE with the FOIA process. At 

that time] as unaware of STA ne 19, 2015 joi posu to 

STATE regarding the FOIA review process [n offered [t us IPS extra 

reviewers from the intelligence community to help review the 30,000 emails. However, many of those 


reviewing officials arrived untrained to formally review items. After the initial training, those reviewers 
became instrumental to the review process. 


emails, which the 


bé 


ИШ not felt as much pressure regarding the review and release of the 30,000 emai ътс 


Is as 


Instead of pressure, it felt more like curiosity as to the raw numbers of emails 
already reviewed, upgraded from unclassified to classified, referred to outside agencies, and/or released 
publicly. To date, approximately 1,600 referrals were made to USIC partners. Many of those emails 
discussed foreign governments and their leaders along with various sensitive telephone calls. Other 
emails existed that would later be referred to the USIC. Those emails included emails from STATE 
personnel discussing information lost as a result of the “Wikileaks” scandal 


Some material from the 30,000 emails, though unmarked as such, were definitely classified back 


in 2009-2012 and still remained classified. On the other hand, it was true some material (in general, not 
specific to the 30,000 emails) could have been previously classified, but were later downgraded. An 
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example would be CLINTON's travel schedule or security-related information based on specific times 
and places. It was a very large security concern for IPS when they heard some STATE employees 
assumed all documents on unclassified system were unclassified, based on being on an unclassified 
system and having no portion markings. 


One email that was upgraded from the 30,000 emails was an email exchange between CLINTON 
то 7] [Lc RENE S) individuals used their personal email 
addresses to discuss matters related to Russia. Despite this, esponded to KENNEDY's request 


for all STATE-related personal emails with a letter that state: ad no STATE-related emails in 
his personal email account. 


STATE was normally able to complete classification upgrades very quickly. The upgrade would 
happen after STATE bureaus and other agencies determined, 1) how the information was obtained; (2) 
what the information was; (3) based on current global events/situations; or (4) because the information 
was, initially, improperly marked as unclassified 


NER. the argument that some of CLINTON' s emails were unclassified back in the 
2009-2012 timeframe when they were initiated, but were later classified due to various circumstan 
ing ified to become classified years after the fact. 


National Archives would be a good point оі 
contact for knowledge on the upgrading process in general 


about August 10, s Г Office of the Secretary of Defense (OSD) called 

ind told her CENTCOM records showed approximately 1,000 work-related emails between 
CLINTON's personal email and General David PETRAEUS, former Commander of CENTCOM and 
former Director of the CIA. Most of those 1,000 emails were not believed to be included in the 30,000 
emails that IPS was reviewing. Out of the 30,000 emails, IPS only had a few emails from or related to 
PETRAEUS, as well as a few related to Leon PANETTA, former Secretary of Defense. There were a lot 
of emails to/from Denis MCDONOUGH, former Deputy National Security Advisor and current White 
House Chief of Staff. 


lescribed Jacob SULLIVAN and Cheryl MILLS as “gatekeepers” for sending 
CLINTON emails/material; they would filter or revi items that CLINTON would receive. 
recommended the FBI talk to his tof specifically about individuals at STATE 
who hold a weekly meeting about Congressional records production and the FOIA process as well as 


felt pressure came from regarding upgrading any of the 296 Benghazi-related emails. 
ecommended the FBI should talk "umm the alleged 1,000 emails between 
CLINTON and PETREAUS. 
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(U//FOUO) On June 23, 2016, MONICA HANEY was interviewed 
Investigation (FBI) Special Agents| at 
Washington, DC rik Representing HANLEY, and also present for the 


interview, were “| After being advised of the identities of the 
interviewing agents, and the purpose of the interview, HANLEY provided the following information: 


(U//FO9O) HANLEY created an archive of HILLARY R. CLINTON's 
emails in March 2013 as a result of concerns related to a reported hack of SIDNEY BLUMENTHAL's 
email account. HANLEY recalled participating in a conference call with НОМА ABED d JUSTIN 
COOPER following the hack to discuss changing CLINTON' s email address. EBEN 
have also participated in the call. While the group ultimately decided together to change "5 
account, ABEDIN selected the new name of the email account, hrod] 7:@clintonemail com. 


(О/ ӨНӘ) COOPER set up the email account and assisted HANLEY with the technical details 
concerning creating a backup of dr22(clinton п. COOPER provided HANLEY an Apple Mac 
aptop from the Clinton Foundation, which HANLEY took home to her apartment "РР 
HANLEY remotely signed on to CLINTON's email server from her apartment, as COOPER 
telephonically walked her through the steps to transfer the emails from the server to the laptop and a 
thumb drive. HANLEY used MacMail, a built in application on the laptop, to transfer the emails. 
HANLEY initiated the process, and left the computer running, as the entire transfer process took a few 
days 


(U//F8:89) CLINTON's email address was changed from 1 
before the archive was created. 


ntonemaii.com to 


(U//FOUO9) While HANLEY could not recall the specific model of the aforementioned Apple 
aptop provided by COOPER, she did recall the model was not an "Air," but was likely a "Pro" because it 
ad an ethernet port and a thumb drive portal. HANLEY further provided that the laptop she received 
from COOPER was silver in color and seemed like a newer model. The thumb drive HANLEY used was 
something she happened to have laying around the house. She could not recall any details concerning the 
rand or appearance of the thumb drive. 


Investigation on — 6/23/2016 at Washington, D.C. 


File # joz Daie dictated N/A 
эзы — —l1s[ — ] 
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(U//F8UO) Although it never actually happened the way it was intended, the initial purpose for 
creating two backups of і er com (one on the laptop and the other on the thumb drive) 
was so а backup was available at both CLINTON' s New York and Washington, DC, residences. The 
laptop remained at HANLEY's apartment i until she 
transitioned to a job in th in early 2014. HANLEY thought the laptop was 
stored in a drawer or on the desk in her bedroom. HANLEY did not use the laptop after the transfer of 


emails, nor did she have knowledge of anybody else accessing the laptop. The laptop was also password 
protected, so it would be impossible for anybody to access the laptop without HANLEY's assistance. 


(U//F8HO) HANLEY could not recall whatever came of the thumb drive she created, and 
searched her apartment multiple times in attempts to locate it. HANLEY thought she might have given 
the thumb drive to ABEDIN when she transitioned ep. as she provided ABEDIN with 
several items upon departure. However, HANLEY did not specifically recall providing ABEDIN with 
said thumb drive. 


(U//FGUO) After the emails were transferred from o the laptop and 
thumb drive, the intention was to delete the emails off the CLINTON email server. HANLEY would not 
have been involved with deleting emails, and assessed COOPER would have been responsible for 
deleting anything directly from the server. 


(U//F9UO) In 2014, after she was no longer working for CLINTON, HANLEY realized she still 
had possession of the Macbook containing CLINTON's archived emails. HANLEY subsequentl 
contacted Platte River Networks (PRN) on her own accord and spoke Muro] 
HANLEY initially tried to remotely send the archive via the following application, which 
provided HANLEY via email: 


https://broker g =DROS1-438-782, HANLEY initially attempted to 
transfer the archive to remotely from CLINTON's New York residence via the 


aforementioned website, however it did not work. HANLEY subsequently attempted to send the archive 
remotely from her own residence, and was also unsuccessful. HANLEY and timately 
decided HANLEY would ship the laptop containing the archive t and he would transfer 


the archive to CLINTON's PRN server. going to wipe the laptop and return it to 
— who was CLINTON' at the time. HANLEY shipped the 


laptop t las they discussed, but was not aware of what happened to the laptop thereafter. 


(U//F889) CLINTON did not know her email login information, as HANLEY would generally 
change the information in CLINTON 's BlackBerry when necessary so CLINTON's email would 
automatically populate. When CLINTON's password required changing, HANLEY would choose a new 
password, update CLINTON’ s BlackBerry with the change, and notify ABEDIN, COOPER and BRYAN 
PAGLIANO. HANLEY had CLINTON's email logon information and password, so she could check 
CLINTON's email if needed. On occasion, CLINTON would ask HANLEY to research an old email that 
CLINTON was unable to pull up on her BlackBerry. In order to respond said request, HANLEY would 
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open up CLINTON's email account remotely from a computer and print the document for CLINTON 
HANLEY assumed ABEDIN also accessed CLINTON' s email account on occasion 


(U//F606) HANLEY often purchased replacement BlackBerry devices for CLINTON when she 
was Secretary of State. CLINTON preferred BlackBerry devices that contained a roller-ball rather than 
the more modern touch pad. HANLEY recalled purchasing most of CLINTON's replacement BlackBerry 
devices from a Washington, DC, AT&T Store in DuPont Circle. HANLEY also recalled purchasing one 
BlackBerry from an AT&T store in the Pentagon City Mall in Arlington, VA. HANLEY also recalled 
purchasing a replacement BlackBerry for CLINTON from either Ebay or Amazon, but stated this took 
place after CLINTON's tenure at the Department of State. 


(U//F8UO) HANLEY had little insight into the writing process of CLINTON's book/memoir. 
She recalled CLINTON meeting with the writers regularly for multi hour meetings, where she assumed 
CLINTON would share topics and anecdotes she wanted to cover in the book. HANLEY also printed out 
chapters of the memoir as it was being written so CLINTON could make edits. HANLEY had no 
knowledge of the writers having access to CLINTON' s emails. 


(U//FOtJO) At the conclusion of the interview, HANLEY agreed to provide interviewing agents 
copies of emails she exchanged 57 iT 


(U//FO9UO) A copy of the original interview notes are attached in a 1A envelope. 
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DECLASSIFY CN 12-31-2041 
FEDERAL BUREAU OF INVESTIGATION TATE 03-22-2014 
ояте) On February 27, 2016. 3А 
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arcium ie FBI Wes 
ü i i s attori Beth Wilkinson and Alexandra М. Walsh. from Wilkinson, b6 
31 Section Chief Peter P. Strzok. as well as David Laulinan, bic 
Irom the Department of Justice (DOI). Prior io 
ыш. Wilkinson and Walsh agreed to sign a non-disclosure agreement in anticipation uf vie! wing 
s during the interview that were jed as part of a Special Ac Program (SAP). After 
td of the identities of the interviewing agents, and the purpose of the interview, SULLIVAN 
following information: 
as recruited Б ]to be an advisor for HILLARY CLINTON 
i 1 "Sue in 2009, 
e (DOS). In and 
ULLIVAN became 
manajsed and supervised 
approximately 30 people iid his specific duti t DOS, were prescribed 
by CLINTON, Under ber tomir traveled with CLINTON on almost every business trip she b6 
took and acted as а conduit to nS ЫЧ produced pofley papers ъс 
and proposals with a ge vend day-to-day. 7 
SULLIVAN recalled соот 
gered t arver Foreign Sen 
slp SULLIV: 
ef topics. These communications included emails written 
wink forward to CLINTON based on his judgement as 
in Principal's Committee (PC) ineetings with CLINTON in the Situation Room. 
Oc y morning throughout ber tenure 
8:43am meeting with her deputies to discuss u broad re 
i "^ E IL bs 
CLINTON'S legal i sur d bist ай. CHERYL MILLS ътс 
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ror Ep402? 


adidonal Chista 
S was involved in all 
A ABEDIN ax CE 

y uperations to include scheduling and trip planning for CLINTON. SULLIVAN described 


ABEDIN as a close confidant of CLINTON and as someone who had a "trusted relat 
LIN 


(UFO) SULLIVAN had two computer systems ini 
Headquarters (HOJ: one on the Secure Internet Protocol Route 
fied information ap to the Secret level and one on an unclassified пем 
al DOS email account oa both af the foregoing networks. Duc to size restr 
email accounts, he often fad to "archive" emails to create space in his emai? account. SU 
recalled archiving email in "big chunks? but otherwise. could not recall any methodology or science he 
applied when archiving email. it was SULLIVAN'S practice to use his state.gov email account for ай 
TOS related business, SULLIVAN did recall eceasionally using his personal googie email (gmail? 
account for DOS business when traveling and on the weekends. Although SULLIVAN could log-in to his 
хине вох email account while away from the office. he used his gmail aceount for DOS business because 
jt way sonieumes difficult to log-in to his state gov email account from his residence on the weekends and 
while waveling. SULLIVAN could not recall any DOS guidance involving the use of personal email fer 
work purposes, SULLIVAN could not recall any guidance from CLINTON regarding the use of personal 
email for work purposes. At some point in his DOS carver, БОНДДУ recalled receiving some form ot 
notification that Chinese actors were targeting the gmail accounts of DOS employer: LLIVAN did 
fiot recall taking пу асбон as it related to this notification. SULLAV A’ MILLS, and ABEDIN did not 
have access Io the Joint Worldwide Intelligence Communication System (QWICS) at the DOS. 
SULLIVAN recalled being briefed on the elements of information security upon indoctrination to the 
DOS. SULLIVAN understood the DOS "upelass" process as ар unclassified document that at some point. 
or wher combined with other documents, would become classified. SULLIVAN could not provide an 
iple to this effect, 


office on the 77 oor at DOS 


ЛУ 
tions on SOLLIV 
ИМАМ 


rat the 
H receiving an 
g issued а secure mobile phone by 
he White House for a weekend. 


(ОЛРӨ НӨ SULLIVAN had secure telephone equipment in his office on the seventh foc 
DOS. SULLIVAN w ued a BlackBerry mobile device by the DOS and did not reca 
upgraded handset during his tenure, SULLIVAN vould not recall v 
the DOS. SULLIV recalled being issued a secure mobile phone E 


bot conid not recall anything further about this device or bis use of it. 


(SEPA When traveling overseas for his work at the DOS, SULLIVAN roched being briefed an 


ILLIVAN recalled an 


revalled 
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stems while traveling overseas, SU 
re call. conduct a secure video teleconference. or use the secure computers pi 
ation needed to take place at the classified level. SULLIV A. 


bl 
b3 


did not conduet foreign travel for personal reasons while at the DOS. 


ДА recalled CLINTON had а Secure Comparimented Information Facility 
(SUI) in ber residence in Washington DC with secure phone and fax equipment. CLINTON also 
could not recall i£ CLINTON had à 
ЇР ш computer terminal in ber residence, SULLIVAN would primarily fransmil or communicate 
classified information то CLINTON at her DC residence through a secure call. SULLIVAN could net 
recall il CLINTON used а secure mobile phone. SULLIVAN was not familiar with the infrastructure in 
home in Chappaqua, bot assumed it had the same capabilities as her DC residence. 

did not know if CLINTON had staff at her residences that also held security clearances. 


(ШЖ ӨӨ) SULLIVAN recalled CLINTON bad an "enormous? amount of information, to 
inelade cla: d information, briefed to her in-person or provided to her through paper Row, CLINTON 
would ninety digest the Presidential Daily Brief (PDB) in paper form and conduet policy meetings 
daily, SULLIVAN recalled little to no classified information passed to CLINTON electronically, in most 
instances, if information needed to be sent to CLINTON, it was routine that a senior FSO in the DOS 
Operation Center on the 7^ floor of DOS HO would facilitate the transmission, Ш CLINTON needed tu be 
present to receive the information, as in the case of a secure call or fax, coordination would be done 
through CLINTO 


S бм. 


(НӨӨ) SULLIVAN recalled CLINTON used a personal email address when she worked in 
the Senate and while she was at the DOS, but was unaware emai! was hosted on a private email server in 
her residence until it became public knowledge in March 2013. Moreover, SUL ET knew Ј 
COOPER and BRYAN PAGLIANO, but never bad a conversation with them regarding any private email 
LIVAN had no memory of a conversation regarding tederal records retention or FOIA 

; ay it related to the use of private email. SULLIVAN knew the general guidelines at the DOS 
1 to federal records retention, For example. SULLIVAN knew not ti delete email fram his DOS 
email accounts. Upon leaving DOS, SULLIVAN boxed up bis official DOS paper records and tamed 
them over to the DOS, SULLIVAN recalled the DOS handled the preservation of his email record: 
28 i recalled one brief conversation in the summer of 2014 with MILLS and 
pertaining to the production of federal records. but could not recall more detail. b6 
b7C 


am 


ӨНӨ) The email address SULLE recalled CLINTON using was 
ип. SULLIVAN also recalled that HUMA ABEDIN had a géclintonemail addr 


eed — — 3 : 
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bur could not remember if specifically s and 
never requested that ong be issued to him. SULLIVAN was unaware of any back-ups, migration, deletion 
or wiping of email from the clintonemail.com domain. SULLIVAN recalled a conversation with 

HEATHER SAMUELSON in the Gall of 2014 where SAMUELSON told SULLY, 
look through documents to see if they constitute а federal record. but this prow 


he may need w 
never occurred 


{LEP @HE) Upon initiation of his employment at DOS SULLIVAN received a TOP SECRET 
(TS) Sensitive Comparumented Information (SCV security clearance, in order to receive the foregoing 
clearance, SULLIVAN recalled an orientation and briefing where handling. transporting, and 
serninating classified information was discussed. As far as he andersioud. SULLIVAN had derivative 
classifiention authority and could classify information based on the guidance ofac fication manual, 
Other than CLINTON, SULLIVAN was unaware of anyone at DOS that had Original Classification 
Authority (OCA). As part of bis job. SUE. was briefed into a large number of SAP and covert 
avtion programs. The process of being bi ] into a SAP required an individual from the DOS Bureau of 
hitelligence and Research (INR) to brief the program and ensure the requisite forms were signed and 
maintaincd, SULLIVAN did not recall ever handling SAP material on a TS computer system, but was 
aware INR had TS computer systems. 


1 
d 


bl 
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it 


POHO SULLIVAN stated a PC meeting wood be initiated by the NSC chair and would 
ng whatever topic the 


Committee (DC) meeting 
agency's conclusion pertaining to the prescribed topic. For the DOS. 
the PC 


совр would author packayes and then Tunnel them through] bé 
CLA for use In the PC meeting, SULLIVAN would sometimes be involved m bc 


bureat had a stake in the issue. In that instance, SULLIVAN would author sections of written packages 
that covered the issue. SULLIVAN would gain his knowledge and source his docament through а 
combination of things he read, conversations he had and classified information. When tbe PC occurred, 
ugeney would usually bring their Principal plas one other representative, For the DOS. it wus often 
"ON and the respective Deputy that attended a PC meeting, S НАЈУАМ attended PC meetings 
mally” and could nut recall a precise amount. 
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oH) Aller reviewing an email dated Jane 17, 2011 with subject line “Plan tar PC 
tomorrow" SULEIVA AN stated he bad 
already viewed this email when released by the DOS through a Freedom of Information Act {Fi 
request, SULLEV lid nol recall the specific email or what the PC meeting was about. 5i 
anderstoad "nonpaper" to mean an unclassified document without official markings given toa f 
government that states the urasfficial position of the US government. SULLIVAN understood "nonpaper" 
io mean this because he had created a “nonpaper™ document for CLINTON before. In the context of the 
ved email. and while reading. it in the moment, SULLIVAN thought CLINTON would have wanted 
hin to make an unclassitied version ef the document, summarize the contents, and then send it to her on a 


ied information very 


idis; 


SAND Afier reviewing an email dated October 13. 2012, with sy 
on Blue," SU stated fie did not remember the email specifically 


This um Green 


SHOWS 
SULLIVAN 


and first 


warked as colleagues n des 


(POED) Alter reviewing an email dated April 10, 2011. with subject fine "Tw: Stevens Updare 
{important} SULLIVAN stated he did not remember the email specifically. SULLIVAN did not think 
the email was unusual and wasn't surprised APRICOM information would be cited in an un fied 
vitai. SULLIVAN would regularly review situation reports from around the world in unelass 
SULLIVAN know| as a career FSO that worked in the DOS Operation Center. 
SULLIVA hvoukt regularly де events from around the world in unclassified email ind 
had no reason to question judgement regarding the proper bandling of clas: ified information, 


was at the Pentagon and СТА. 


Afer reviewing an email dated December 27, 2011. with 
Ted he did not remember the email specifica 


had no reason to believe any DOS 
employees be worked with ever mtentionulTy mishandled с! d information а jd the bes! 
could to make а sound judgement when haralling classified information! 
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(UPPOCED After reviewing an email dated July 4, 2009, with subject Hine "Pw: Follow 
Summary of 10 DT ОРЕК Conference Call." SC AN stated he did not remember the 


specifically. SULLIVAN did not spevifivally recall the м] SUI d 
did recall tf еге орар шыр Ur ind knew her to be a senior Watch Officer in the 

DOS Operation Center. When asked about the content of the email and if he believed the pending military 
activities of a foreign military v i ü 


he worked with ir DOS worked hard while under pressure and used the best judgement they could to 
aveumplish the missien, SULLIVAN was unsure why forwarded this particular стай to his 

il account, but reeled being in Idaho around this time for а bachelor party, SULI IVAN stated that 
and could not recall another instance where it occurred 


gna 


procedure was pot routine practice fo 


URBO Айат reviewing an email dated April 27. 2012, with subject line "Fw: Day 
stated he did not remember the email specifically. SULLIVAN knew the “LA proc tu 


nier: process, SULLIVAN reeafled the general subject matter of the email and remembers 
trying to open the Ground Lines Of Communication (GLOC) between countries after 


attacks involving the International Security À ince Fores USAF). 


(54 
‘Times ariete өп Salehi, 


lier reviewing an email dated 


August 25, 2010, with : 


bject line "Pw: NY 
Ийса ЧН LAN 


as forward eman to 


6, 2012. with subject 
zd be did v email 


LLL ter reviewing an email dated July 


D. 


After reviewing an email dated February 25, 2012. with 
emember the emait specifically, but recalled 
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emal spectlically. SU 
reporting in a manner he believed w be sensitive but unclassified. SULLIVAN мака 
have sent this email on an rd iem because the drone sirike could have already hit the news 

i ri er the made ii less sensitive. but was 
belie pe ee io a "secure call” in 
attempt to delineate between what could go in unclassified and 

fied vhannels. Ta SULLIVAN stated this email was not out of step with how people 
xched similar matters at the time. Nothing stood out to SULLIVAN at the time as mishandling 
classified information. 


(СЕ ӨНӨ) Aller reviewing an email dated May 16. 2011. with subject Hine “Re: Senator Kerry 
bas requested to speak with Secretary Clinton.” SULLIVAN stat ed he had a general revolivetion of the 


event discussed in th emaii, but did not recall the email specifically. SULLIVAN did not recall the 
conversation with refereneed in the email. 


i8) IUSEQUOT/ After reviewing an email dated August 24, 201 1. with subject Нас “R: Rasmussen 
enti" SU N stated he did not remember the email specifically. SULLIVAN stated he usually found 
out abou hrough open source reports, DOS email reflecting news accounts and more rarely. 
through someone in Me DOS HQ building. 


After reviewing an email мш sith 
subject line SULLIV AN: ма he, did not remember the email specifically. 


determing what he was referring to by the 
ut he was not sure, 


After reviewing an email аа jab subject 


LLIVAN stated he did not remember the email specifically, SULLIVAN stated the 
regarding the nomination of a second strike was with stated he 
inficquenty conimunicated swith and, when he did, it was through a mix of secure calls, 


ified calls and unclassified emails. 
ing an email а] i 


A fier review? 


fin: ШУ. zl he did not remember the email specifically. SOLLE did not 
necati how he communicated with} and guessed it was not by phone and most likely, 


and pasted from another unclassified email. SULLIVAN did not recall speaking with 
zenerally. While working at the DOS, SULLT 
mething he read in an unc fied email. SULLE 
rexsed a cuncern with the type of information coming over the un 


could not recall an instance where 
ified email system or 


stated he can't recall one time be felt 
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judgement was good and that they hag a good understanding of how to handle cla 
Generally, while at the DOS, SULLIV. ated he had to pay attention to what infos 
channel, Fer instance, he would convey what he could on an unclassified system and then g 


equipment authorized to handle classified communications te convey more information. 


Ad s attorney, BETH WILKE 
d the emait was pending ef 
WILKINSON stated her client would not answer questions related to the foregoing ent 
ducuments related to the email. 


i or апу 


Сенна» БОЛДУ 
years back and was someone who Икеа to help the cause. 
BLUM HAL had a variety of sources of information. БАЛДА 


someone CLINTON knew from 
N understood it. 

unaware of the identities of 
THAL would sometimes refer to 
VAN understood those people to be 
retired with no access to classilied information. SULLIVAN would occasionally talk to IMENTHAL 
through phone conversations and maybe through email. In thase conversations. BLUM THAL would 

í opies BLUMENTHAL thought were relevant and SULLIVAN 
stakeholders to have them validate the information. SULLIVAN 
THAL had access to, or was relaying, classified information. 


ош pass i on to CLE 
never heard ofa concern that BL. 


UPES The original notes of the interview. signed aforementioned non-disclosure 
agreements, wid documents displayed to SULLIVAN will be maintained in а 610-340 envelope and filed 
the cuptioned investigation. 
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(U//FOU8O) PATRICK FRANCIS KENNEDY, Under Secretary of State for Management, was 
interviewed at his office at Department of State (DoS), Harry S. Truman Building, 2201 C Street NW 
Washington, D.C., by Federal Bureau of Investigation (FBI) Special Agents (SA. nd b6 
a Also present for the interview was FBI National Security Law Branch (NSLB) Attorney ET 
ind Senior DoS Counsel After being advised of the identity of the interviewing 
agents, and the nature of the interview, KENNEDY provided the following information: 


(U//ROHO) KENNEDY was aware Secretary of State HILLARY CLINTON used a personal 
email account during her tenure as Secretary, but was unaware that she was using a personal server. 
KENNEDY received an unclassified email from CLINTON approximately once a month and noted those 
emails came from a clintonemail.com address. 


(U//F&'UG) The DoS “GO” system allows for DoS employees to remotely access their DoS 
account from а non-DoS server. DoS policy does not support the routine use of private email accounts for 
for DoS business. However it was understood that exceptions could be made in emergency situations, and 
in doing so, the employee should carbon copy their DoS email account for matters of record. 


(U//F&'89) KENNEDY mostly received emails from CLINTON after hours, and so infrequently 
he was not aware of the volume of which she was using her personal account. KENNEDY was not aware 
CLINTON was solely using a personal email account for communicating unclassified DoS business. 


(U//F&8O) DoS policy does not support the use of private email servers for continued personal 
use, nor the use of personal servers for DoS business, thus there is no approval process for their use. DoS 
policy remains the same for the use of both personal emails and servers today as it was during 
CLINTON's tenure 


(U//FOtjO) KENNEDY recalled news stories implying a former DoS employee, BRYAN 
PAGLIANO, set up CLINTON's private email and server "on the side" while working for DoS 
However, KENNEDY noted he was not aware of PAGLIANO' s involvement until it hit the press. DoS is 
refraining from direct inquiries into PAGLIANO's involvement until the FBI completes its investigation 


Investigation on — 12/21/2015 at Washington, D.C. 
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(U//FOtSO) KENNEDY had no direct knowledge of any of CLINTON's predecessors [COLIN 
POWELL and CONDOLEEZZA RICE] using private email accounts, but noted he was aware POWELL 
publically mentioned he used a private email account during his tenure as Secretary of State in his most 
recent publication 


(U//FGUO) DoS has the responsibility of interfacing with foreign diplomats and political 
representatives within the United States and overseas to help develop policy. Sometimes information 
from these dignitaries is given in confidence and sometimes it is not. The classification of such 
information is specific to the situation. KENNEDY explained that information given in confidence may 
be initially transmitted as unclassified to report the information, but later “up-classified” when it is further 
assessed the disclosure of such information might damage national security or diplomatic relationships. 
Ultimately, the originator of a document or email is responsible for classifying the document. 


(U//F&8O) KENNEDY explained the Intelligence Community (IC) “steals” information, and thus 
has to classify said information to protect sources and methods. DoS may get the same information 
through diplomatic channels and not classify that information because it was not received from a sensitive 
source or a method. According to KENNEDY, the classification of a DoS document depends on the 
content of the message and if it is important for the other party not to disclose the information. 


(U//FOHO) If a DoS employee wanted to use classified information derived from IC sources in an 
unclassified channel, they would need to submit a tearline request to do so. DoS cannot declassify a 
document that was not originally classified by a DoS classification authority. 


(U//FOHO) The Secretary of State is a declassification authority, as are the Secretary's Chief of 
Staff and Deputy Chief of Staff. KENNEDY believed CHERYL MILLS, JAKE SULLIVAN, and 
possibly HUMA ABEDIN would have been classification authorities during CLINTON's tenure at DoS 


(U//F8G8O) KENNEDY acknowledged DoS received their first request to produce emails related 
to CLINTON's email sometime in 2014. The request was related to a Congressional inquiry concerning 
documents related to the 2012 attack of the United States consulate in Benghazi. The initial request was 
focused on specific emails, but was later expanded to include a broader production 


(U//FOUJO) KENNEDY was not part of the initial dialogue with CLINTON concerning the 
aforementioned request for emails. KENNEDY was only involved with interacting with Congress 
concerning the status of the request, but was not involved in the process of deciding what was and was not 
released in response. The DoS Freedom of Information Act (FOIA) team directly handled the request by 
reaching out to the appropriate Bureau or Secretariat who maintained the information concerning 


Benghazi. The Bureau of Near East Affairs would have been contacted by FOIA in regards to general 
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FOIA team would have reached out to the records staff in the Executive Secretariat for specific 
CLINTON communications concerning Benghazi. 


( DoS FOIA inguiries are handl he Bur f Administration/ Global Information 
Services| The DoS Bureau involves a 
team of supervisors, processors and reviewers, almost all of which are retired foreign or civil service. The 
supervisors assign the requests to processors who load the information into their FOIA management 
system and send out requests to all the Bureaus who have a relevant relation to the request. The review 
team collects the information received from the relevant Bureaus and determines what if any exemptions 
should be considered and/or applied. The FOIA review team also determines if the information 
responsive to the request contains any outside agency equities, and appropriately coordinates with those 
agencies to respond to the request. Furthermore, the FOIA response goes through a review and 
reconciliation process to ensure all responsive documents are marked and redacted appropriately. 

ааа regards to the DoS FOIA process. However, there is an 
appeals process which involves a FOIA review board managed out of the DoS Information Oversight 
Office 


b6 


(U//FOG'9O) Responsive documents to FOIA requests are also placed on the DoS FOIA website in 
their releasable form to avoid redundant FOIA requests from other parties 


(U//FOUO9) KENNEDY recalled discussions concerning CLINTON wanting to cull her emails 
prior to producing emails related to the Congressional/FOIA requests. The purpose of the cull was to 
remove emails related to personal communications between CLINTON and her family that were not 
relevant to DoS matters. DoS was not involved in the cull, as it is the responsibility of the individual to 
produce records of relevance for the record. KENNEDY did not recall who was involved in assisting 
CLINTON cull her emails. 


(U//FEUO) DoS employees identify their own files for the record and can generally archive them 
in the State Messaging and Archival Retrieval Toolset (SMART) system, which allows for electronic 
marking/tagging of emails for the record. However, SMART is not used by the Executive Secretariat, 
thus CLINTON would have likely had to use a print and file system, or simply keep all of her emails for 
the record. As a matter of personal preference, KENNEDY retains all of his electronic DoS 
communications in an active file. 


(U//FOUO) When asked in retrospect if he had concerns over how DoS conducted its response to 
the FOIA request regarding CLINTON’ s emails, KENNEDY responded “yes and no.” KENNEDY did 
not elaborate. KENNEDY further explained he contacted the FBI Deputy Director and requested an 
electronic copy of all the CLINTON emails tumed over to the FBI in regards to the FBI's investigation, 
so DoS could make a better assessment in regards to evaluating their role/response. 
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(U//F88O) KENNEDY “categorically rejected" allegations he attempted influence FOIA 
markings to protect and/or mask classified information. peep ee а] b6 
and described her as someone who “says it like it S nei fear of telling truth to power." BIG 
KENNEDY further explained he has full confidence would not allow undue influence to 


effect her ability to properly carry out the FOIA process in accordance with the Presidents mandate to 
both air on the side of transparency and national security. 


(ЦШ/# ӨНӨ) KENNEDY was one of three people he was aware of at DoS who have the authority 
to upgrade the classification of a document, the Secretary of State а ___ Jbeing the other two, A 
classification upgrade would be warranted in a situation where the change in a government may change 
relationships, and information that would not have endangered the United States or sources before said 
government change would then be considered a threat to national security or to the sources safety. 


ъ7с 


(U//FO'89) KENNEDY stated he was available for re-contact should interviewing agents have 
additional questions to ask at a later date. 


(U//FOUO) Agent notes are maintained in a ТА envelope. 
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Information Resource Management/Executive Secretariat, US Department of State, oj ES one 
nd S 


was interviewed by Federal Bureau of Investigation (FBI) Special Agent (SA) 
After being advised of the identity of the interviewing agents 
and the nature of the interview, rovided the following: 


(esee) Information Resource Management 
(IRM) for the Executive Secretariat (IRM/ES) and was in that position during Secretary HILLARY 
CLINTON 's time in office. Part pum ^ was to maintain and support the infrastructure for 
the UNCLASSIFIED and SECRET networks for the Executive Secretariat. Every Department of State, 
hereafter State, Secreta has interacted with, except for Secretary JOHN KERRY, has used 
personal email during his or her time in office. For example, Secretary COLIN POWELL used America 
Online. Secretary Clinton, however, was the first Secretary to use a privately maintained email server, 
hereafter See. ia not agree with the decision, but it made sense to him because 
Secretary CLINTON had used the Server for the previous two years. Secretary CLINTON did not have a 
desktop computer in her office to access email while at State, but did have non-SCIF space near her office 
where she could use her BlackBerry believed Secretary CLINTON received an 
operational security briefing that involved the National Security Agency after being sworn in as Secretary 
of "e IEEE 6 the Bureau Security Office would have coordinated the briefing. 


evo ——  þecame aware of Secretary CLINTON's Server at the time she was 
sworn in as Secretary of State. She was offered a State email address, but decided to use the Server from 
her 2008 presidential campaign. It wasatthistimd — фе: BRYAN PAGLIANO 
PAGLIANO was the administrator for Secretary CLINTON's Server, зо þinteracted with 
him to keep it communicating with State systems. For example, there were approximately 5-6 instances 
where emails sent by Secretary CLINTON to State employees, or vice-versa, were not received by the end 
user. In these instances; and PAGLIANO worked together to modify settings so the emails 
would make it through. Additionally, the two worked to establish transport layer security (TLS) between 
State systems and the Server as a security measure 


(U//FO8O) Since PAGLIANO was an IRM Schedule C employee of State меа 
him to various briefings regarding security and system vulnerabilities. PAGLIANO's job at State was 
policy development related to mobile computing, so these briefings were also relevant to his role in that 
capacity. ишш n recalled discussions about Bluetooth vulnerabilities and blue jacking, 
because 
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those vulnerabilities мее pimay concern due to Secretary CLINTON's BlackBerry use. 
Although аде an effort to keep PAGLIANO informed of security matters, he was not be 


involved in decisions regarding Server security, nor dod ^ фом if the Server was hacked or b7C 
actively monitored for intrusions m— i not believe it was possible for PAGLIANO to secure 
the Server as well as State servers, which are monitored and hardened by a team of full time employees. 
Additionally, he did not know how the Server was paid for or where it was physically located. 


(FOUO) In approximately February 2011, several State employees were the victims of a gmail 
and yahoo hack where users received an email with ali irecti to change their email password. 
The link took users to a fraudulent site that allowed to obtain the user' s gmail/yahoo 
password. The hackers then used the pee to modify the users gmail/yahoo account to auto-forward 


toa group sent a security alert to POEMS users regarding thep1 per pos 

hack, but since PAGLIANO was not a POEMS user, he would not have received the alert - 
(шене) was asked to delete approximately two emails related to the public E 

release of Secretary CLINTON's emails. The request was in relation to cleaning unclassified State 

systems, however, due to an FBI preservation request] þad not deleted any 

communications. He recalled one of the emails being from an Ambassador and began with a phrase b6 

similar to “Му classnet is down, so I'll start here..." could not recall any other details, but ere 

offered to provide a copy of the emails if requested. There were no spills of classified information on 

Secretary CLINTON's email account while she was at State insofar a. was aware. 


(U//FOUO) Secretary CLINTON received classified information in a paper briefing book that 
was maintained by her special assistant. When outside of Washington, DC, State travel teams turned 
hotel rooms into classified information processing areas where personnel, including the Secretary, could 
communicate securely. 


(Ц/Ж ӨНӨ») Only Secretary CLINTON's inner circle could email her directly. This group 
consisted of JAKE S RYL MILLS, and HUMA ABEDIN for State Department purposes. 
For this reason, ^ — Г ABEDIN's BlackBerry, he considered it the equivalent of pe 
emailing Secretary CLINTON. EE 


qwmese) [шей the FBI's investigation would be incomplete without talking to 
PAGLIANO. PAGLIANO is a very sharp and ke iis individual who likely took action based b6 


on the security information and briefings provided by| nd others. Furthermore, DIC 
она additional information could exist on the accounts of MILLS because she served 


as a proxy for Secretary CLINTON 
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STEVE A. LINICK, Inspector General, United States Department of State, Office of Inspector 
General (STATE 1G), 2121 Virginia Avenue, NW, Suite 8100, SA 3, Washington, DC 20037, telephone 
Гаа 5 су was interviewed in person by 
FBI Special Agents After being advised of the identity of the 
interviewing Agents and the nature of the interview, LINICK provided the following information: 


On or about March 12, 2015, STATE IG received a letter from U.S. Senators Bob Corker, Richard 
Burr and Ron Johnson. The letter requested a review of State Department employees' usage of personal 
email for official purposes and coordination with relevant agencies to determine whether classified 
information was transmitted or received by State Department employees over personal systems. On April 
16, 2015, pursuant to this letter, STATE IG initiated a review of the use of personal communications 
hardware and software by five Secretaries of State and their immediate staffs. The review covered current 
Secretary of State John Kerry all the way back to former Secretary of State Madeleine Albright. STATE 
IG's review was further broken down into three categories 1) On-boarding Process (which looked into the 
approval process for the use of personal networks), 2) Preservation of Records (how records were 
maintained/preserved), and 3) the FOIA response. 


LINICK believed STATE IG's office was not qualified to determine whether classified 
information was transmitted and referred that portion of the review to the Office of the Inspector General 
of the Intelligence Community (ICIG). Separately, STATE IG had the Benghazi review and 

The 
Department of State was also conducting a Freedom of Information Act (FOIA) review of fifty five 
thousand pages of emails belonging to Secretary Clinton pursuant to a court order. In December 2014, the 
Department of State received hard copies of those documents from Secretary Clinton' s Counsel 


LINICK initially believed Department of State received electronic copies of Secretary Clinton's 
email from her private server. During a July 1, 2015 meeting with STATE IG, Patrick KENNEDY, Under 
Secretary for Management, U.S. Department of State wc et ei STATE IG the 
Department of State had obtained an electronic copy of Secretary Clinton' s email. On July 10, 2015, 


STATE IG requested two copies of the .PST files for use by STATE IG and ICIG. Later, KENNEDY 
advised STATE IG that the Department of State only had hard copies of the documents, which were 
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scanned and uploaded to ClassNet. LINICK obtained preserved Department of State email records for 
MILLS and ABEDIN. 


On May 26, 2015 ICIG and STATE IG sent a joint preservation letter to Williams & Connolly for 
the @clinontonemail.com account records in their possession. Although, LINICK was generally aware of 
the status of ICIG' s ongoing review to identify classified information, which consisted of jointly working 
with the Department of State FOIA staff, LINICK was not s uuu in that process. LINICK 


recommended the FBI interview Department of State employees, (Office of Information 
Programs and Services — [office of Global Information Services Во — fana 
Wee involved in the FOIA review lleged there were potenti, 
classified emails found during their review.| further alleged that ee 
currently working at State Department were meddling with the FOIA review process. 


On or about June 19, 2015 STATE IG and ICIG jointly made four recommendations to the State 
Department related to the FOIA review process. The recommendations were as follows 


1. Recommend State Department FOIA office request staff support from IC FOIA offices to assist in 
the identification of intelligence community equities; 

2. Recommend IC FOIA officers review the emails to ensure that ClassNet use is appropriate before 
transmitting to the State Bureaus for review; 

3. Recommend State Department FOIA seek classification expertise from the interagency to act as a 
final arbiter if there is a question regarding potentially classified materials; and 

4. Recommend State Department FOIA Office incorporate the Department of Justice into the FOIA 
process to ensure the legal sufficiency review of the FOIA exemptions and redactions. 


Based on a later response from KENNEDY, the Department of State had 
recommendations number one and three. LINICK suggested the FBI talk to| 
who both worked at STATE 1С. land 
would be able to give more insight into the FOIA review process, and STATE IG's 
interaction with Secretary Clinton's counsel, Williams & Connolly. LINICK believed fhad sent 
emails back and forth with David KENDALL, Secretary Clinton's attorney. 


land 


LINICK surmised the Department of State Foreign Affairs Manual that was in use during 
Secretary Clinton's tenure as Secretary of State did not give clear and specific guidance regarding the use 
of private email, although it was highly discouraged. If employees used private email to conduct official 
State Department business, that email had to be forwarded to an @state.gov email within twenty days 
after being sent. The Department of State had no process for approving the use of private networks. There 
were no rules in place that specifically denied Secretary Clinton the use of her private network 
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LINICK did not believe he was qualified to explain the Department of State's retroactive 
classification process. LINICK did not know whether the Department of State had provided a safe to 
Williams & Connolly, nor did LINICK know if the Department of State had the authority to certify a non- 
government facility as secure storage for classified information. 


LINICK advised Secretary Clinton had brought Bryan PAGLIANO into the Department of State 
to set up her private network. PAGLIANO was still a Department of State employee who worked in the 
Department of State' s information technology department. However, PAGLIANO refused to be 
interviewed by STATE IG. PAGLIANO informed STATE IG he was represented by counsel from Akin 
Gump Straus Hauer & Feld, LLP. LINICK recommended the FBI interview PAGLIANO. 


LINICK did not intend on directly contacting Secretary Clinton to request electronic copies of her 


private network email. Since there was a spillage of classified information, for which STATE IG is not 
equipped to handle, the referral was made to the FBI. 
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JUSTIN GREGORY COOPER, date of birth (DOB 
[| and social security account number (SSAN) was 
i Bureau_of Investigation (FBI) Special Agents БЕ 


at the law offices of b7C 
located at Washington DC 


. Also present for the interview were attorneys 
and С as well as attorne 
U.S. Department of Justice У mca | 


Assistant United States Attorney for the Eastern District of Virginia. 
After being advised of the identity of the interviewing Agents, and 
the nature of the interview, COOPER provided the following 
information: 


Before commencing the interview, COOPER's attorney 

stated the offices of were in possession of two (2) 
Apple MacBooks and one (1) Seagate external hard drive belonging to 
COOPER. COOPER used one of the MacBooks from approximately 2009 to 
2013 and transferred his files to the second MacBook in approximately 
2013. The Seagate external hard drive contained back-up files 
belonging to COOPER. On the foregoing digital media existed files 
related to the upgrade of former Secretary of State HILLARY CLINTON's 
BlackBerry, incurred while COOPER upgraded HILLARY CLINTON's 
BlackBerry device in 2009 and 2011. These files were separate, 
segregated and labeled in folders on each of COOPER's digital media as 
described above. Additionally, each of COOPER's digital media items 
contained email exchanged with an email address belonging to HILLARY 
CLINTON, as) indicated COOPER is willing 
to discuss providing the FBI the folder containing BlackBerry files 
relating to the upgrade of HILLARY CLINTON's device, and all email 
involving the email address . Additionally, 
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indicated COOPER did not have the right to provide consent to b6 
search the foregoing BlackBerry files and to gain consent to search, bic 
believed the FBI would need to consult HILLARY CLINTON's 
lawyers at WILLIAMS AND CONNOLLY. 


COOPER stated he worked for former President BILL CLINTON 
for approximately 16 years as an aide serving many capacities. In 
2007, COOPER and other aides debated using a private server for the 
sole purpose of email exchange and as a result, a contract with Apple 
was signed for the set-up and administration of an OS X server 
(hereafter, Apple server). The foregoing Apple server was installed at 
the CLINTON residence located in Chappaqua, New York and was online in 


and around June 2008 and configured for a handful of users. COOPER 
recalled bé 
having email bc 


accounts using the domain presidentclinton.com. The domain 
wjcoffice.com was another domain used for BILL CLINTON related staff 
and email, but COOPER referred to it as a legacy domain that had 
mostly forwarded email. BILL CLINTON did not have an email account on 
the Apple server and did not use email as far as COOPER understood. In 
January 2009, HILLARY CLINTON was looking to move away from a 
BlackBerry with AT&T service, and decided to register the domain 
clintonemail.com and host it on the Apple server. COOPER had no 
specific memory, but believed he could have been the individual to 
register the domain because he handled financial issues for the 
CLINTONs. In or around January 2009, the users determined the Apple 
server was not robust enough and based this assessment on unreliable 
BlackBerry connectivity. At that time, the Apple server was not run in 
conjunction with a BlackBerry Enterprise Server (BES). 


In or around March 2009, BRYAN PAGLIANO, an Information 
Technology (IT) professional used by HILLARY CLINTON, took full 
control of setting up a Windows Small Business Server (hereafter, 
Windows server) as well as a BES, at the CLINTON residence in 
Chappaqua, New York. PAGLIANO built the server from equipment used in 
HILLARY CLINTON's campaign for the democratic nomination to run for 
President of the United States. COOPER did not know where PAGLIANO 
built the server, but knew it was in place and running at the 
Chappaqua residence in or around March 2009. COOPER was aware that 
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PAGLIANO set-up firewalls, spam filters and possibly Cisco Adaptive 
Security Appliance (ASA) software, but only PAGLIANO would know the 
configuration of the set-up. PAGLIANO managed the porting of users 
from the Apple server to the Windows server, as well as handled all 
software upgrades and general maintenance. COOPER believed there was a 
back-up drive as part of the Windows server and wasn't aware of any 
additional back-ups, although he recalled many boxes around the 
Windows server and reiterated PAGLIANO would know the exact 
configuration. Concerning the various avenues of connectivity to the 
server for user devices, COOPER referred Agents to PAGLIANO. 
Cablevision provided internet service to the CLINTON residence in 
Chappaqua, and that internet service was used to connect the Windows 
server. COOPER believed no outside spam service provider was retained 
for the Windows server. COOPER believed in instances where the Windows 
server went down, like in the event of a power outage, emails were re- 
directed to a gmail account as a back-up. COOPER was aware of two (2) 
power outages, based on storms or natural disasters, occurring during 
the lifecycle of the Windows server, but was not aware of any specific 
users or corresponding gmail accounts that had email forwarded. 


COOPER was granted administrator rights, along with 
PAGLIANO, to the Windows server and described his role as the customer 
service face. As part of this role, COOPER could add a user or reset a 
password. COOPER also continued in his role of acquisition or 
purchasing for the CLINTONs, and this extended to server related 
items. For instance, COOPER recalled using both Network Solutions and 
GoDaddy to register domains, but would only have used these companies 
because he was directed to, either by Apple or PAGLIANO. COOPER read 
in the press about the Windows server being associated with a company 
called Perfect Privacy, and would not be surprised if it was accurate, 
but had no specific memory of using the company. COOPER registered a 
Secure Socket Layer (SSL) at PAGLIANO's direction and recalled it 
being used for more security when users accessed their email from 
various computers, and eventually, iOS devices. Additionally, COOPER 
vaguely recalled the Windows server using a Microsoft software product 
called Forefront. 
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COOPER stated there was no official security policy given to 
users of the Windows server. Generally, when users received 
suspicious emails and forwarded them to COOPER, he would forward them 
to PAGLIANO. As an administrator of the Windows server, COOPER would 
get emails indicating brute force attacks (BFA). COOPER would also 
forward those to PAGLIANO and recalled PAGLIANO installing Internet 
Protocol (IP) blocking software in an attempt to thwar he BFA. On at 
least two (2) occasions, COOPER remembers napi Special 
Agent in Charge, United States Secret Service, aware of suspicious 
email received on the Windows server. 


COOPER recalled conversations between CHERYL MILLS and BRYAN 
PAGLIANO in or about June 2013 pertaining to the decommissioning of 
the Windows server and the next phase of communication infrastructure 
for HILLARY CLINTON, after her tenure as Secretary of State in 2013. 
Although COOPER wasn't involved and doesn't recall how they were 
selected, PLATTE RIVER NETWORKS (PRN) was chosen to maintain a server 
for the CLINTONs. COOPER did recall some communication with PRN 
regarding the transfer of user names and accounts from the Windows 
Server to PRN. An individual employed by PRN named[ — ]rast Name 
Unknown (LNU) was granted administrator rights on the Windows server 
in order to effect the transition to PRN's control. At this point, 
Interviewing Agents displayed a document to COOPER identifying 
administrator accounts on the Windows server. COOPER identified the 
administrator account ү as most likely being the user name 
ғ] LNU from PRN. In or around July 2013, COOPER received 
instructions for his email account that indicated PRN was in control 
of the Windows server email data. Due to COOPER's transition in 
employment, his email account was off the server in or around November 
2013, COOPER does not know when the Windows server was shut down and 
how or where it was transported. 


COOPER had no knowledge of the process HILLARY CLINTON 
undertook when acquiring her emails from the clintonemail.com domain 
and providing them to the Department of State as part of a Freedom of 
Information Act (FOIA) request. COOPER speculated that PRN was 
involved in the acquisition of the entire content of her account and 
DAVID KENDALL was consulted when determining which specific emails 
would be turned over. 
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COOPER believed the Windows server had three domains: 
wjcoffice.com, presidentclinton.com and clintonemail.com. To the best 
of COOPER's memory, he recalled 


b6 
b7C 


having email accounts using the domain presidentclinton.com or 
wjcoffice.com, as part of their work for BILL CLINTON. COOPER believed 
HILLARY CLINTON, [o о and HUMA ABEDIN had email accounts 
under the domain clintonemail.com as part of their association or work 


for HILLARY CLINTON. COOPER believed the Windows server was used 
exclusively for the exchange of email. 


COOPER has never stored or transmitted classified 
information over an unclassified network and was unaware of any 
discussions regarding the transmittal of classified information on an 
unclassified network by others. 


Notes of this interview, as well as the document displayed 


to COOPER, will be maintained in a FD-340 envelope and filed with the 
captioned investigation. 
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U//FOHO) On March 2, 2016, JUSTIN GREGORY COOPER, date of birth (DOB| — — ] b6 
9 social security account number(SSAN)L__ was interviewed by Federal Bureau 216 
of Investigation (FBI) Special Agents SA] Oë had  ] at the law 
offices шынынын Г” af «(| Washington DC 20006. Also 
and 


resent for the interview меф] ee es eae 
as well as U.S. Department of Justice attorneys, 
After being advised of the identity of the interviewing Agents, and the nature of the 


interview, COOPER provided the following information: 


(О/ ӨНӘ) After reviewing an email referencing a new laptop for HILLARY CLINTON, 
COOPER recalled a Macbook Air purchased for CLINTON in the 2008 timeframe, but did not believe 


she ever used it. He did not recall the backup ook was likely 
purchased with a credit card because СО! to CLINTON's em 
accounts and, therefore, had credit cards| COOPER was not 


involved in the setup of the Macbook, but believed it was setup to access CLINTON's email. The intent 
was for CLINTON to use the Macbook in addition to her BlackBerry. In addition to COOPER, HUMA 
ABEDIN[ — — Jand, later, MONICA HANLEY frequently assisted CLINTON with 
setting up any new technology devices 


(U//FGUJO) COOPER was aware CLINTON had Sensitive Compartmented Information Facilities 
(SCIFs) in both her New York residence as well as her residence in the District of Columbia (DC). The 
SCIFattheDCresidenc[ —  ] COOPER knew CLINTON to have access to the SCIF bé 
and knew ABEDIN was frequently there, but did not know if ABEDIN could access the SCIF when it BIE 
was secured, COOPER did not have the combination to open the SCIF. The SCIF doors at both 
residences were not always secured, including times when CLINTON was not at the residences. When 
CLINTON became the Secretary of State, COOPER assisted the team from the United States Department 
of State (State) with questions regarding the communications infrastructure at the New York residence. 

Both residences had safes, home computers, secure Cisco phones, secure and non-secure fax, and secure 
video capabilities inside of the SCIF. COOPER was unaware of who would receive secure faxes when 
they were transmitted. The only individual at either residence COOPER believed to have a clearance was 
possibly. — в a result of his time in the military. 
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(U//F8'8O) Leading up to the installation of the Apple Server, COOPER, for several reasons, 
identified a need to setup a private email server located at the CLINTON residence. Those reasons 
included 


e segregating different aspects of WILLIAM CLINTON 's post-presidency activities 


* separating politics from the work of the Clinton Foundation 
E 


President CLINTON's office and might attempt to gain physical access to the server if it 
was located in the office 
• An outside vendor might not report a hack attempt 


(Ц/ ӨНӨ) After a series of phone calls with Apple, COOPER contracted with Apple Business 
Services to setup a server, hereafter Apple Server, for handling email for a small number of users working 
in the office of President CLINTON. COOPER did not recall how he paid for the Apple Server, but he 
likely used a credit card. Apple installed the Apple Server in the basement of the New York residence, 
however, COOPER did not recall if he was present for the setup. The CLINTON family and the staff at 
the New York residence were the only individuals with physical access to the Apple Server. The Apple 
Server design included a backup to an internal RAID drive. Apple assisted COOPER with the setup of 
the wjcoffice domain on the Apple Server, but Apple did not have ongoing access to the Apple Server or 
its contents. COOPER was the only one with administrative access to the Apple Server initially, later, 
BRYAN PAGLIANO was given access to effect the transfer of data on the Apple Server to a Microsoft 
Exchange server, hereafter Exchange Server. COOPER did not assist in exporting any of the data or files 
to the Exchange Server, nor did he create any archives of clintonemail.com data. The decision was made 
to move to the Exchange Server because the Apple Server did not keep up with changing developments in 
technology and, eventually, users experienced problems with email delivery on their BlackBerry devices. 


(U//FOUO) COOPER believed HILLARY CLINTON had an email account on the Apple server; 
however, ABEDIN did not have an account. CLINTON either came up with or approved the username 
HDR22 for her email address. 


(U//FOtJO) After reviewing an email fragment referencing a potential hack of the Apple Server, 
COOPER stated he could not recall any details and did not believe the hack was ever confirmed. 


(U//F8U9) CLINTON obtained а new BlackBerry device whenever she had an issue with her 
device, such as a trackball failure, cracked screen, or the device was too heavy. When one of these issues 


occurred, whoever was working in close proximity to CLINTON would obtain a new device for her. 
COOPER believed НАМУ] le be the individuals who procured new devices b6 


for CLINTON. He did not recall obtaining devices on eBay or similar outlets. COOPER sometimes bre 
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assisted others with completing the switch to a new device by leading them through the process of 
backing up data from the old device and transferring it to the new device. After these steps were 
complete, COOPER would activate the new device on the Apple Server or, later, the Exchange Server. 
The two BlackBerry backups previously provided to the FBI by COOPER were likely from situations 
where COOPER directly handled the transition between devices. In these cases, COOPER destroyed the 
old devices by breaking them in half or hitting them with a hammer. 


(U//FOtJO) After reviewing an email referencing the replacement of CLINTON and ABEDIN's 
SIM cards, COOPER stated he did not recall a process whereby users would regularly switch SIM cards 
in their mobile devices, nor did he recall why CLINTON and ABEDIN received new SIM cards in the 
specific situation referenced in the email. 


(U//FGUO) After reviewing an email dated May 30, 2009, COOPER stated he could not recall 
any details regarding a new BlackBerry for CLINTON in that timeframe. 


(U//FO'3O) After reviewing an email regarding new security policies, COOPER stated Research 
in Motion (RIM), provided new tools on a regular basis to increase the security of BlackBerry devices. 
Typically, when a user switched to a new device, COOPER would implement an updated security policy 
on the device. As an example of a feature he would add to a security policy, COOPER stated he required 
users to enter a more complex password. Users on older devices would have the old security policy. 


) TheiPads used by CLINTON were for reviewing email and other content. COOPER 
stated [D dad for CLINTON's use of an iPad. Regarding specific iPads, COOPER recalled 
an iPad mini and at least one iPad having a cellular data connection in addition to a wireless network 
connection. COOPER never set up any of the iPads and, therefore, had no information on Apple IDs, 
iCloud accounts, or device passwords. One of the iPads locked out CLINTON's email account on one of 
the servers when it attempted to connect using an old password. COOPER could not recall on which 
server this event occurred 

(U//F8GUO) After reviewing an email dated July 26, 2010, with the subject line “Re: CC for 
hPad," COOPER сопбтшей[ þurchased an iPad for CLINTON on or about that date. 

(U//FGUO) After reviewing a chart with the heading “202 " COOPER stated he 
recognized the phone number as CLINTON' s second phone number. CLINTON usually carried a flip 
phone with her BlackBerry because it was more comfortable to talk on. Additionally, CLINTON could 


use her BlackBerry while talking on the flip phone. COOPER did not recognize any of the specific 
phones displayed in the chart 


(U/FeHO) COOPER stated —— and he utilized Google 


hosting services for email when there was a problem with the Apple Server or Exchange Server. To 
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effect this change, COOPER would alter the settings on a user's device to check Google for new 
messages. COOPER could not recall if CLINTON or ABEDIN utilized Google hosting services during 
Hurricane Sandy or other outages. If they had used Google, it would have been a team effort to set up 
their devices because COOPER was traveling at the time. 


(U//FOGUO) After reviewing emails regarding the transfer of an archive of HILLARY 
CLINTON's emails, COOPER stated he did not recall providing a laptop to HANLEY for this purpose, 
but it was conceivable he could have repurposed a laptop from President CLINTON' s office and assisted 
in the transfer of the email files. COOPER did not recall a USB flash drive containing the email files. He 
also did not recall HANLEY returning the laptop in early 2014; however, he became a consultant to 
President CLINTON in the fall of 2013 and was no longer involved in day-to-day business by 2014 


(О/ЖӨБӘ) COOPER had minimal contact with Platte River Networks (PRN). He recalled one 
interaction wit to pass along passwords, but did not have any other involvement 
with PRN. COOPER did not have an email account with President CLINTON's office after he became а 
consultant. 


(U//FO80) COOPER had no knowledge of Freedom of Information Act production or the cull 
down process, as it related to CLINTON's emails from her time as Secretary of State. 


(U/FOUO) Notes of this interview, as well as the documents displayed to COOPER, are 
maintained in a FD-340 envelope and filed with the captioned investigation 
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(U//FeHe&) On June 21, 2016, JUSTIN GREGORY COOPER, date of 
and social security account number 
was interviewed telephonicall E ral Bureau 
FBI) Special Agents (SA) and 

all for the interview were 

ann sd as well as attorney 
U.S. Department of Justice. After being advised of 
the identity of the interviewing Agents, and the nature of the 
interview, COOPER provided the following information: 


birth 
(SSAN) 
of Investigation 


5 


(U//F686) COOPER recalled a personally-owned iMac computer 
in the Sensitive Compartmented Information Facility (SCIF) of both the 
Washington, DC and Chappaqua, NY residence of HILLARY CLINTON. Despite 
not knowing the exact model, COOPER described them as being identical 
models with a one inch thick monitor. 


(U//#686) COOPER stated an Apple server was set-up for email 
exchange for aides working for former President WILLIAM CLINTON. 
COOPER did not recall a specific person deciding to set-up the server, 
but more a consensus among aides. 


(U//fOUC) In or around December 2008, COOPER recalled having 
conversations with HUMA ABEDIN pertaining to HILLARY CLINTON moving 
away from an AT&T provided email account and establishing an email 
domain on the Apple server. COOPER and ABEDIN discussed a covert email 
domain versus a domain including the CLINTON name. ABEDIN "blessed 
off" on the @clintonemail domain name and COOPER registered the domain 
in January 2009. COOPER could not recall who created the handle of 
HILLARY CLINTON's email account but thought 
she typically approved her email account names. COOPER did not know if 
anyone else had HILLARY CLINTON's email account password, but stated 
if anyone would, it would be ABEDIN. 
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(U//F889) COOPER did not have a specific memory of 
registering HILLARY CLINTON's email domain and setting up her 
clintonemail.com account on the Apple server. Most likely, COOPER 
believed he registered the domain, and added HILLARY CLINTON's email 
account to the Apple server, because he could think of no one else 
that would have performed that task. COOPER stated he most likely 
initially set HILLARY CLINTON's ‚сот account to 
forward to her BlackBerry. When HILLARY CLINTON Would reply from her 
BlackBerry, her email address would represent as 

222 With that configuration, HILLARY CLINTON's 
incoming email content would have resided on the Apple server for a 
period of time, but not her sent messages. Again, COOPER stated this 
was "all a blur" to him and he was relaying the most likely scenario. 


(U// F686) In early 2009, COOPER recalled conversations with 
ABEDIN regarding moving to another email server system, but could not 
recall specifics. COOPER recalled ABEDIN knew BRYAN PAGLIANO from his 
work on CLINTON's 2008 presidential campaign and held him in high 
regard. PAGLIANO began building a new email server system in early 
2009. PAGLIANO had to have been given access to the Apple server in 
order to migrate email accounts and content to the new server he 
built. COOPER did not recall giving PAGLIANO administrator access to 
the Apple Server. 


(U//Fe89) COOPER did not specifically recall acquiring an 
Apple computer for HILLARY CLINTON to use in April 2009. In general 
COOPER recalled multiple attempts to get CLINTON to use Apple 
products. 


(U//£e89e) Around January 2011, COOPER recalled receiving 
numerous alerts in his email indicating email account users of 
PAGLIANO's server were entering the wrong log-in credentials. PAGLIANO 
had set-up the server so that COOPER would receive failed log-in 
notifications. COOPER thought this to be a brute force attack on the 
server and contacted PAGLIANO. COOPER recalled nothing else regarding 
this incident. 


(U//F989) COOPER recalled HILLARY CLINTON's email account 
was changed to ? after SIDNEY BLUMENTHAL's email 
account was hacked around March 2013. Although COOPER could not be 
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certain, COOPER thought he could have been the one to change the email 
address for CLINTON. 


(U//F989) COOPER thought PAGLIANO had disabled the built-in 
Administrator account on the server PAGLIANO built. COOPER had his own 
system administrator account on PAGLIANO's server. 


(U//Fe89) In order for Platte River Networks (PRN) to begin 
administering an email server for the CLINTONs, PAGLIANO ЗЕН t] 

access to PAGLIANO's server. COOPER was unsure when this took 
place, but thought it was in May or June of 2013. COOPER did not know 
lf [___}renovea COOPER's administrator account. 


(U//EeHo) COOPER could not recall when he last logged into 
PAGLIANO's server. COOPER did not know what “IP scanning tools” were. 


(U//f689) In the spring of 2013, COOPER recalled giving MONICA 
HANLEY a MacBook laptop and walking her through downloading CLINTON's 
email from the PAGLIANO server to the MacBook. COOPER did not recall a 
specific purpose for this other than maintaining a back-up copy of 
CLINTON's email. COOPER was unaware of a USB Flash Drive containing 
CLINTON's email. COOPER was unaware of the location of the MacBook 
containing CLINTON's email. 


(U//F689) COOPER state[ Таа not have access to the 


Apple server in anyway. 


(U//Fe8Ue) Notes of this interview will be maintained in a FD340 
envelope and filed with the captioned investigation. 
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(U//FOtJO) On February 19, 2016, ERIC J. BOSWELL, DOB} 
Federal Bureau of Investigation (FBI) Special Agents 


was interviewed by 


Washington DC. Also bic 
present for the interview was BOSWELL 's attorney| After being advised of the identities 

of the interviewing agents, and the purpose of the interview, BOSWELL provided the following 

information 


(U//FGHO) BOSWELL served as the United States Assistant Secretary for State for Diplomatic 
Security (DS) from June 2008 until December 2012, however, BOSWELL did not resign from DoS until 
the Fall of 2013. Following his resignation from Department of State (DoS), BOSWELL went into 
"When Actually Employed" (WAE) status with DoS, which essentially means he still works for and is 
paid by DoS on an as needed basis 


(U//FO'UO) As the Assistant Secretary of State for Diplomatic Security, BOSWELL was 
responsible for overseeing the security of DoS communications, personnel, and programs 


(U//FGUO) BOSWELL did not directly oversee the security of the Executive Secretariat, to 
include former Secretary of State HILLARY R. CLINTON. A Security Officer who reported further 
down in BOSWELL's chain of command had direct oversight over the Executive Secretariat on the 
seventh floor offices commonly referred to as “Mahogany Row.” BOSWELL could not recall the names 
of any of the Security Officers who were assigned to Mahogany Row during his tenure. 


(U//FGUO) BOSWELL had no knowledge CLINTON was using a personal email, nor that she 
was operating said email off of a personal server while she was Secretary of State. He first learned of the 
private server and personal email use when it was reported in the Press. BOSWELL further stated he 
found former Secretary CLINTON to be “very responsive to security issues." 


(U//FOUO) Agents asked BOSWELL to review a redacted memo titled "Use of Blackberries in 
Mahogany Row." The memo was redacted by DoS in response to a Freedom of Information Act (FOIA) 
inquiry. After reviewing the memo, BOSWELL stated the memo was drafted early in the Administration, 
and shortly after CLINTON began her tenure at DoS. 
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(U//FG8O) BOSWELL recalled CLINTON's DoS executive staff initially inquiring about the 
possibility of acquiring Blackberries that could be configured for classified material. BOSWELL, tasked 
his staff to research the request and possibilities. BOSWELL staff notified him that such a 
device/configuration was not possible, which was relayed to CLINTON's executive team via the memo. 


(U//F8'8O) Furthermore, BOSWELL stated that he recalled there was general concern around the 
same time regarding the possibility that CLINTON's staff might use their Blackberries on Mahogany 
Row, which is a Sensitive Compartmented Information Facility (SCIF). According to BOSWELL there 
was no specific instance or report that any specific person/people were using Blackberries on Mahogany 
Row at the time. However, there was some general concern within DoS security personnel that 
CLINTON's executive staff may try to use their Blackberries in the SCIF as they were almost all brought 
on to DoS from CLINTON' s campaign team, and thus were very accustom to using their Blackberries. 
Although BOSWELL could not recall a specific report of the use of Blackberries on Mahogany Row, he 
stated that “they were told to stop (using their Blackberries in the SCIF) and they did.” DS never 
sanctioned the use of Blackberries on Mahogany Row 


(U//FOVO) Agents also asked BOSWELL to review a redacted email dated 1/24/2009 with the 
subject line “Series of questions." The email exchange, which BOSWELL was not copied on, related to 
the set up of a "stand-alone separate network PC" for CLINTON. In response, BOSWELL stated the 
email was written three days after CLINTON began her tenure as Secretary of State. LEWIS “Lou” 
LUKINS who was included in the referenced email exchange, was the former Chief Administrative 
Officer of the Executive Secretariat. BOSWELL explained that a "stand alone" work station does not 
necessarily mean a workstation that was not connected to the DoS network, and it just referred to a 
normal computer workstation. BOSWELL was unsure if CLINTON ever used a workstation at DoS, and 
did not recall ever seeing a workstation in her office. 


(U//FOUO) A copy of the original interview notes and the referenced memo are attached in a 1A 
envelope. 
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(U//FG8UO) On June 15, 2016, LEWIS LUKENS, Date of Birth was. 
interviewed by Federal Bur f Investigation (FBI) Special Agent: hd — 1] 
[E his ae E San Francisco, CA. After being advised of the identities of 
the interviewing agents, and the purpose of the interview, LUKENS provided the following information: 


(Ш/Ж ӨБӨ) LUKENS is currently the Diplomat in Residence for the Pacific Northwest region of 
the US, for the US Department of State (DOS). LUKENS, a career DOS employee, was most recently the 
US Ambassador to Senegal, before which he was the Deputy Assistant Secretary of State for the 
Executive Secretariat. As the Deputy Assistant Secretary, from the summer of 2008 until June of 2011, 
LUKENS reported to the Executive Secretariat, who was initially DAN SMITH until he was succeeded 
by STEPHEN MULL. LUKENS was responsible for providing operational and logistical support to 
approximately 800 individuals at the DOS, which included the Secretary of State, senior leadership and 
their staff. LUKENS responsibilities were broken into five main areas: Human Resources, Budget, 
General Services, Diplomatic Security (DS), and Information Resource Management (S/ES - IRM). 


(U//FEU6) S/ES - IRM was responsible for ensuring that the senior leadership of DOS had the 
Information Technology (IT) tools and systems they needed to do their jobs. The group was led by JOHN 
BENTEL and was comprised of approximately 25 to 30 individuals who were a mix of DOS personnel 
and contractors. LUKENS interacted with BENTEL on a daily basis. He described BENTAL as having 
“decent [technical] skills” despite not being a “tech guy” and added that he was more technically 
proficient than LUKENS was. LUKENS was not aware of the statements that had been attributed to 
BENTEL in the recent OIG report, but thought they were out of character for BENTEL. 


(U//F889) LUKENS worked with CHERYL MILLS апі HUMA ABEDIN before and during 
HILLARY CLINTON's transition to DOS to coordinate CLINTON' s office space and human resource 
needs. LUKENS explained that the previous Secretary only had one Deputy Secretary but CLINTON 
planned to have two Deputies, so LUKENS had to reorganize the offices on the 7" floor to accommodate 
the second Deputy. LUKENS worked with DAN SMITH and Under Secretary PATRICK KENNEDY at 
DOS to ensure that CLINTON's needs were met during the transition. LUKENS stated there was not a 
computer in CLINTON's office at DOS because CONDOLEEZZA RICE did not have one, and one was 
not installed for CLINTON. 


(U//FG89) LUKENS and representatives from DS and S/ES-IRM visited CLINTON's residence 
in Washington, DC during the transition to assess what equipment was present and what needed to be 
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installed. LUKENS provided that both secure and unsecure telephone and facsimile systems were 

installed at the residence. LUKENS did not recall if there was a computer in the ing! 1 

LUKENS did not visit CLINTON's residence in Chappaqua, NY and instead A ани 
in his place. LUKENS was not aware of what equipment was installed in 


Chappaqua. LUKENS stated that the DS representative for these visits was mostly likel 
who was later replaced B ds the summer of 2009, 


(U//F8UO) LUKENS was shown an email with the subject “State Department Telephone Services 
at Secretary Clinton's Residence" that was sent аа LUKENS апа ABEDIN оп 
January 27, 2009. After reviewing the email, LUKENS explained that “IST/Red Switch” refers to the 
direct phones to the White House, “Business Lines” refers to unclassified phone lines, and “Ops 
Dedicated Drop” refers to a phone line that connected directly to the DOS operations center. LUKENS 
was not sure what "CMS VoIP” referred to but thought it was related to DOS Crisis Management 
Support. LUKENS noted that equipment was installed both in a SCIF and in an office area located near 

| LUKENS stated that he oversaw the installation of the telephone lines in a very 
broad sense but the actual work was very technical and beyond his expertise. 


(U//FOtUO) 
equipment. LUKE escribe s likeable but noted that he often interacted directly wit! 


CLINTON 's staff and did not always keep his chain of command informed of requests from, and work 
begin done for, CLINTON and her team. 


(U//F9U9) LUKENS was shown an email with the subject "Secretary Residential Installation 
Hotwash" that was sent from — Jo BENTELL anh do March 
17, 2009, LUKENS was not immediately familiar with the email or the attachment but believed that 
“Server: Basement Telephone Closet” referred to a telephone server. LUKENS noted the installation 
processes was unique because there was pre-existing equipment in the residences that had previously been 


installed for President WILLIAM CLINTON 


(U//FOUO) LUKENS was not aware that CLINTON was using a private email server until it was 
released in the papers. Upon learning about the server, LUKENS had some general concerns about how 
the server had been protected from hackers. LUKENS did not know if the setup was a violation of any 
existing DOS policy at that time. LUKENS never had any conversations with CLINTON's staff or other 
department officials about the server. 


(U//F889) LUKENS was shown an email with the subject “HRC blackberry" that was sent from 
MONICA HANLEY to ABEDIN on August 30, 2011. After reviewing the email, LUKENS provided that 
he was unaware of the email and that BENTEL never relayed any information to him about the server or 
it being nonfunctional 


(U//FOUO) LUKENS was shown an email with the subject "S Communications" that was sent 
from ABEDIN to MULL on August 30, 2011. LUKENS was familiar with the email and provided the 
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context that the technology at DOS was not very user friendly and that matters were further complicated 
because CLINTON was not very technology savvy and had little patience for technology issues. 


(U//F889) LUKENS was shown an email with the subject “Re: Series of questions" that he sent 
to KENNEDY on January 24, 2009. LUKENS was familiar with the email and explained that CLINTON 
could not have her BlackBerry in the SCIF so his idea was to set up a living room area outside of the 
SCIF where CLINTON could check her emails on her BlackBerry. CLINTON did not have a computer in 
her office and did not want one because she preferred to use her BlackBerry for checking her emails 
While DOS users can check personal email accounts via the unclassified DOS computer systems the 
proposed 'stand alone' system would have streamlined the process for CLINTON and would have been 
similar to the setup used by former Secretary of State COLIN POWELL. 


(U//F9UO) LUKENS was aware that no DOS email account was assigned to CLINTON, aside 
from a generic account that was used for sending mass emails to DOS employees on behalf of the 
Secretary. LUKENS was not aware that CLINTON was using a personal email for official business. He 
was told by MILLS that CLINTON was using her personal account to keep in touch with friends and 
family. LUKENS did not email with CLINTON directly and typically communicated with ABEDIN, who 
he described as CLINTON's gatekeeper. 


(U//PO'89) LUKENS was shown an email with the subject “Re: E-mail test" that was sent from 
HUMA to “Н” on February 27, 2010. LUKENS was unaware of the issues discussed іп ш a 


exchange at that time, but he had since seen the email exchange. LUKENS stated that] 
heed BENTEL S group 


(Ц//ЕӨНӨ) LUKENS was shown an email with the subject “Re: S berry" that was sent from 
HANLEY to ABEDIN on August 30, 2011. After reviewing the email LUKENS provided that he had not 
seen the email before and did not know the circumstances in which it was sent. LUKENS did not know 
why BENTEL made the statement regarding FOIA searches in the email. 


(U//FOU9O) LUKENS had heard of the State Messaging and Archive Retrieval Toolset (SMART) 
but was not aware of any specifics about the program. LUKENS believed that SMART had been rolled 
out to all departments at DOS and was not aware that it wasn't used by S/ES - IRM. 


(U//FOUO) Once CLINTON 's transition to DOS was completed LUKENS' primary responsibility 
became coordinating the travel logistics for CLINTON and her team. This included handling matters 
related to passports, customs / immigration requirements, baggage, and hotel arrangements. LUKENS 
travel on all of the trips with CLINTON 


(U//FOUO) LUKENS was shown an email with the subject “Communications Guidance for 
Moscow” the he sent to several individuals on CLINTON's staff on March 15, 2010. LUKENS did not 
recall receiving country specific threat briefs prior to each trip. However, LUKENS recounted that on one 
trip to Russia they received guidance from the Embassy that they should leave their phones on the plane. 
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However, this conflicted with the guidance from DS so they ultimately elected to take their phones off of 
the plane. LUKENS explained that the one.state.gov system referenced in the email was used for 
accessing the DOS OpenNet system remotely using a user specific pin and token. 


(U//FGUO) A copy of the original interview notes and referenced documents are attached in a ТА 
envelope. 
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(Ш/Ж ӨНӨ) On April 5, 2016, HUM i iewed by Federal b6 
Bureau of Investigation (FBI) Special Agents| and| lat the FBI 
Washington Field Office, 601 4" Street NW, Washington DC. Present for the interview was ABEDIN's 
counsel, MIGUEL RODRIGUEZ, Partner at Bryan Cave LLP, KAREN DUNN, Partner at Boies, Schiller 


& Flexner LLP ad| —— JAssociate at Boies, Schiller & Flexner LLP. Also present 
was FBI Section Chief Peter Strzok, as well a: Assistant U.S. Attorney — Eastern 

District of Virginia, and David Laufman jan from the Department of 
Justice (DoJ. unterintelligence and Export Control Section. Prior to the interview RODRIGUEZ, 
DUNN Pr шше to sign a non-disclosure agreement in anticipation of viewing classified 


documents during the interview. After being advised of the identities of the interviewing agents, and the 
purpose of the interview ABEDIN provided the following information 


(U//F9HO) ABEDIN first met HILLARY R. CLINTON in 1996 when she was an intern in the 
Office of the First Lady. She then worked on CLINTON's Senate campaign and her 2008 Presidential 
campaign, as the traveling Chief of Staff. When CLINTON became the Secretary of State, at the 
Department of State (DoS), ABEDIN became her Deputy Chief of Staff for Operations where she was 
primarily responsible for coordinating logistics for CLINTON. ABEDIN worked with JAKE 
SULLIVAN, CHERYL MILLS, JOE MACMANUS, as well as three Special Assistants, a Scheduler, and 
a Personal Assistant while she was in the Office of the Secretary. 


Transition to Department of State 


(U//F889) ABEDIN and CLINTON met with DoS on a few occasions prior to CLINTON being 
sworn into office to discuss her transition. During these instances CLINTON and ABEDIN met with 
Secretary Rice and her staff to discuss the logistics of the transition. ABEDIN worked with PATRICK 
KENNEDY and MILLS to fill the available spots on CLINTON's staff. ABEDIN was directly 
responsible for identifying and interviewing individuals for the roles of Personal Assistant, Scheduler and 
Personal Correspondent. 


(U//FOG8O) ABEDIN provided that KENNEDY was their main point of contact for setting up 
CLINTON's office and that LEWIS LUKENS, MACMANUS апі ere responsible for b6 


coordinating the technical aspects of the transition. ABEDIN did not know that CLINTON hada private 27 
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server until about a year and a half ago when it became public knowledge and did not recall any 
discussion about it during the transition. ABEDIN did not recall any discussions during the transition 
about whether using a private email account for DoS business was permissible. However, she did recall 
that they were advised that they could not have personal emails linked to a DoS device. As a result 
CLINTON elected to use a personal device only because she did not want to carry two devices. 


(U//F606) ABEDIN had never held a security clearance prior to working at DoS. She received а 
Top Secret security clearance at DoS but did not remember being read into any Special Access Programs 
(SAPs) or compartments. When ABEDIN was on boarded at DoS she received a security briefing that 
detailed the different levels of classified information and the proper handling procedures. ABEDIN did 
not recall ever receiving any training on the preservation of federal records but noted that she took a lot of 
training courses when she on boarded so she may have had training on the topic. ABEDIN provided that 
she was not an Original Classification Authority (OCA) at DoS 


ABEDIN's Devices and Communication Practices 


(О/РӨЪӨ) ABEDIN's office was located in a Sensitive Compartmented Information Facility 
(SCIF) at DoS. At her desk she had both an unclassified and classified computer system. ABEDIN was 
not sure if the classified computer system was a Secret or Top Secret (TS) system, and she was unfamiliar 
with the term JWICS. ABEDIN did not receive any formal guidance on what system she should use for 
the different aspects of her work. She did the majority of her work on the unclassified system and would 
often go several days, or weeks, at a time without logging into her classified system. She would only use 
the classified system if she was notified that somebody had sent her a message on that system. In addition 
to the computer systems, ABEDIN had an open line phone and a yellow TS Cisco phone that she typically 
used for talking with the National Security Council. 


(U//F8U9) ABEDIN provided that she was issued an official DoS email account, 
abedinh@state.gov, which she used for DoS related work. She also had an email account that was 
provided by CLINTON, huma@clintonemail.com, which she used for matters related to CLINTON's 
personal affairs and to communicate with CLINTON's personal staff and friends. ABEDIN also had a 
personal Yahoo email жоон. сс т | ABEDIN could access her clintonemail.com 
account and her Yahoo account via the internet on the unclassified DoS computer system. She would use 
these accounts if her DoS account was down or if she needed to print an email or document. ABEDIN 
further explained that it was difficult to print from the DoS system so she routinely forwarded emails to 
her non-DoS accounts so she could more easily print. ABEDIN also had another email account that she 
had previously used to support her husband's campaign activities, 


(U//FO8O) ABEDIN had no knowledge of her accounts ever being targeted by hackers and was 


not aware of any intrusion attempts. ABEDIN recalled that some people at DoS had issues with their 
Gmail accounts but she never had a Gmail account. 
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(U//FOUO) ABEDIN was shown an email dated September 1, 2011, with the subject “Fwd 
Calls”, which she forwarded from her huma@clintonemail.com account to her DoS email account. 
ABEDIN did not recall the specific email or why she would have forwarded it. However, she noted that 
based on the date stamp she knew that she was not in the office when it occurred. 


(U//FOUO) ABEDIN was shown an email dated October 4, 2009, with the subject “Fwd: U.S. 
interest in Pak Paper 10-04", which ABEDIN received fom| — Јава then forwarded to her 
Yahoo email account. ABEDIN was not familiar with the document but was not surprised that she 
forwarded it to her Yahoo account. She explained that she routinely forwarded emails from her state.gov 
account to either her clintonemail.com or her yahoo.com account so that she could print them. ABEDIN 
stated that she would typically print the documents without reading them. At the time of the email, 

worked for RICHARD HOLBROOKE who was the Special Representative for Afghanistan and 
Pakistan (SRAP). ABEDIN was unaware of the classification of the document and stated that she did not 
make judgments on the classification of material that she received. Instead, she relied on the sender to 
make that assessment and to properly mark and transmit the document. 


(U//FO8t3JO) ABEDIN was shown an email chain dated August 16, 2010, with the subject “Re: 
your yahoo acct”, ABEDIN did not recall the email and provided that despite the content of the email she 
was not sure that her email account had ever been compromised. She further provided that the 
referenced in the email referred tol Ja older campaign volunteer in Westchester, NY. 


(U//FOtJO) ABEDIN was provided with a DoS Blackberry and believed that all of CLINTON's 
top aides at DoS were issued Blackberries as well. The team would sometime use secure cell phones when 
they were traveling but they were not used on every trip. Secure phones were only used when traveling in 
hostile operational environments. The secure phones were maintained by Diplomatic Security (DS) and 
would be provided to the team by ABEDIN provided that DS routinely provided country specific 
security briefings prior to international trips. During these briefings the team would receive instructions 
on how to handle their communications once in country. For example the team might be told to leave their 
phones on the plane or to take the batteries out of their phones. ABEDIN noted that the guidance changed 
based on the specific location and that it wasn't uncommon to receive different instructions on separate 
trips to a given country. For example, the communication plan for Moscow could be different than the 
plan in St. Petersburg. 


(U//F8UO) ABEDIN was shown an email chain dated October 6, 2009, with the subject "IT 
security in Moscow” and an email chain dated October 12, 2009, with the subject “Re: Communications”. 
ABEDIN stated that the content of these emails was typical of the guidance that was provided by DS prior 
to a trip and that the instructions were closely followed by the traveling team. If CLINTON was not able 
to attend the DS briefing prior to the team's departure she would be briefed by DS on the plane. ABEDIN 
stated that they used computers that were set up and controlled by the Mobile Communications Team to 
access their DoS and personal emails accounts when they were in Russia. 
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(U/AFOVO) ABEDIN did not recall any potential security issues occurring while the team was 
traveling overseas aside from one instance in Egypt. Prior to a meeting at President Mubarak' s residence, 
the team was unexpectedly asked to leave their phones. ABEDIN could not provide any more details on 
what had occurred but noted that DS was with the team and was aware of the incident. 


The Secretary's Devices and Practices 


(U//FOU0) CLINTON's office at DoS was located іп a SCIF on the seventh floor that was 
commonly referred to as Mahogany Row. Her office had an unclassified telephone and a TS Cisco phone 
for contacting other agencies. Initially, she also had a secure ‘white phone! and a STE in her office but 
they were later removed. CLINTON did not have a computer in her office and conducted the majority of 
her work in person or on paper. ABEDIN explained that CLINTON could not use a computer and that she 
primarily used her Blackberry or iPad for checking emails. If CLINTON needed to check her emails 
during the course of the day she would leave the SCIF to check her Blackberry, often going to the eighth 
floor balcony. CLINTON's email address was not widely known but all of her senior staff had the address 
and would share it with other government officials if they needed it. ABEDIN stated that CLINTON's 
senior staff was not specifically instructed to filter her email but they understood what was relevant to 
CLINTON and would only share information with her as appropriate 


(U//F600) ABEDIN was shown an email chain dated September 30, 2010, with the subject “Re: 
HbJ on moratorium”. After reviewing the email, ABEDIN could not recall the email exchange or the 
context of the email. ABEDIN stated that, in general, she would be told by either CLINTON or the 
requesting party if the call needed to be secure or not. It would be unusual for ABEDIN to read the 
content and then make her own judgment as to whether the call should be secure or not. ABEDIN stated 
that she was likely with CLINTON when she sent the email and she was relaying guidance from 
CLINTON. ABEDIN provided thf an ^ assistants to 
CLINTON 


(U//FOUO) ABEDIN was shown an email chain dated August 30, 2011, with the subject "Re: S 
Communications". ABEDIN recalled the email exchange and provided that CLINTON was not issued a 
DoS Blackberry and that she only used her personal Blackberry because she did not want to carry 
multiple devices. The email exchange occurred when CLINTON was in the Hamptons and was having 
communication issues following Hurricane Irene. At that time, ABEDIN felt that it did not make sense to 
temporarily issue CLINTON a DoS Blackberry because it would require significant effort to transfer all 
of her emails and contacts to a device that she would only use for a few days. ABEDIN did not know 
what STEPHEN MULL meant when he wrote that the account could be set up to mask CLINTON's 
identity. ABEDIN's counsel noted that a longer version of this email chain had been released via the 
FOIA process (DoS case F-2015-12685, document C05905671). 


(ОРН) ABEDIN was shown a memorandum from DS regarding the use of Blackberries in 
Mahogany Row. ABEDIN recalled seeing the memorandum in the news recently but did not recall when 
it was originally released. ABEDIN stated that she did not need her Blackberry when she was in the SCIF 
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so she was not affected by the recommendations in the memorandum. ABEDIN did not remember 
receiving a specific briefing from DS on Blackberry vulnerabilities but stated that it was possible that she 
received one because DS frequently briefed CLINTON's team on security topics. 


(U//FOUO) CLINTON did not have a secure Blackberry and ABEDIN did not know if secure 
Blackberries were even available at that time. ABEDIN stated that CLINTON had several different 
standard Blackberry phones during her tenure. It wasn't uncommon for CLINTON to use a new 
Blackberry for a few days and then immediately switch it out for an older version that she was more 
familiar with. The phones were typically purchased by somebody on her staff and would be activated by 
“whoever was around”. ABEDIN recalled duc o id MONICA HANLEY helped to b6 
setup new Blackberries on different occasions. ABEDIN did not know what was done with the old Buc 
Blackberries after CLINTON transitioned to a new one. ABEDIN was shown an email chain dated April 
15, 2009, with the subject “Re: Won't get to huma today". ABEDIN did not recall why they were 
activating new SIM cards for CLINTON. ABEDIN providedtha[ —— |[LAST NAME UNKNOWN] 
wu] President Clinton's office that may have worked for JUSTIN COOPER. 


(О/ЖӨЪӨ) ABEDIN confirmed that CLINTON's Blackberry phone number was 22[ —— ] bé 
She was not aware of CLINTON ever using a second cell phone and was not familiar with the phone BE 
number 2o[ ^ 1] [It is noted that a 202 area code was erroneously used when ABEDIN was asked 
about the aforementioned telephone. The correct number is ao ou While ABEDIN noted that it 
would be odd for CLINTON to have a D.C. area code, she ultimately stated that no part of the number 
was familiar to her] 


a 


(U//FE00) ABEDIN stated that CLINTON had at least one, or possibly two, iPads during her 

tenure. She believed that one of them might have been a gift. CLINTON used the iPad for reading news 

articles but ABEDIN rarely saw CLINTON carrying or using the iPad. CLINTON was trained on how to 

use the iPad [майе they were оп traveling on а plane. ABEDIN stated that the iPad was bé 
briefly used to send and receive emails following Hurricane Irene when CLINTON' s other email systems вте 
were down, Although this was only intended as a temporary solution, this capability may have remained 

after CLINTON's other systems were restored. ABEDIN noted that she was in Europe when Irene struck 

and that HANLEY was responsible for handling the communication issues following the storm. ABEDIN 
confirmed that CLINTON's email was also down for an extended period of time following Hurricane 

Sandy. However, ABEDIN was in New York City, with her infant child, at the time and was not sure 

what efforts were taken to restore or establish temporary email for CLINTON. ABEDIN was unaware of 

any email accounts, Apple IDs, or cloud storage accounts associated with the iPads 


Email System During Tenure 


(U//F8'89) ABEDIN contacted COOPER about getting a Blackberry for CLINTON while 
CLINTON was still in the Senate. CLINTON then used the Blackberry when she transitioned to DoS. At 
that time, her primary email address was hr! 5@att.blackberry.net. Shortly after CLINTON became the 
Secretary of State COOPER established the @clintonemail.com domain and CLINTON began using 
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hdr22@clintonemail.com as her primary email. The only other person at DoS to receive an email account 
on the domain was ABEDIN. Later in CLINTON's tenure she changed her email address to 
hrod17@clintonemail.com. ABEDIN was not familiar with the email address 
hr15@mycingular.blackberry пеї or with| gmail.com. 


(U//FO9O) Initially COOPER was the primary point of contact for anything related to the setup 
and maintenance of the email system. ABEDIN was shown three separate email chains with COOPER 
regarding the operation of the server during CLINTON' s tenure. The first was sent on January 9, 2011 
and had the subject *Re:", the second was sent January 10, 2011 and had the subject “Don't email hre 
anything sensitive. I can explain more in person" and the third was sent October 20 201 land had the 
subject “Ке”. ABEDIN provided that she did not recall any details surround these email exchanges but 
noted that she trusted COOPER to fix any issues with the server. She did not recall the system ever being 
hacked but assumed that she would have notified CLINTON of any current issues that they were 
experiencing. 


(U//FOG'89) ABEDIN was shown an email chain dated March 17, 2011 with the subject 
“Re:School”. Upon reviewing the email she provided that she was not familiar with the email or the 
topics discussed within it. ABEDIN noted that her email address was misspelled on the chain and 
therefore she would not have received the email. However, she was not aware of the @clintonemail.com 
system ever being hacked. 


(U//FO'9O) ABEDIN provided that BRYAN PAGLIANO had worked on the Information 
Technology (IT) team for CLINTON's 2008 Presidential campaign and was hired at DoS after CLINTON 
took office. Thereafter, BRYAN PAGLIANO became the new point of contact for issues with the email 
system. ABEDIN did not specify when this occurred but stated that there was a transition period during 
which she would contact COOPER and he would direct her to contact PAGLIANO. 


(U//FOUO) ABEDIN was shown an email chain dated December 24, 2012, with the subject “Fw: 
Thank You". After reviewing the emails ABEDIN provided that she did not recognize the 
SMSGS@state.gov email address and was not aware of any other generic email accounts used by 
CLINTON for DoS wide email communications. 


(U//FOUO9) ABEDIN was shown an email chain dated August 30, 2011, with the subject "Re: S 
berry”. ABEDIN stated that she did not like the SSHRC@state.gov email address because it was too 
obvious of an email address. She noted that the email appeared to be related to discussions that occurred 
when they were working to restore CLINTON' s communications after Hurricane Irene. ABEDIN did not 
know who JOHN A. BENTAL was but assumed that he worked in the IT department at DoS. When asked 
about BENTAL's statement that SSHRC@state.gov would be subject to FOIA searches, ABEDIN stated 
that she always assumed that all of CLINTON' s communications, regardless of the account, were subject 
to FOIA if they contained related material. ABEDIN did not recall ever having conversations with 
CLINTON, or any other staff members, about the Federal Records Act and preserving relevant emails. 
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ABEDIN provided that at the time, they believed relevant emails would be captured and preserved by 
DoS if any of the senders or recipients were using an official DoS email account. 


(U//F889) ABEDIN was shown an email chain dated December 16, 2010, with the subject “RE 
mail from clintonemail". ABEDIN recalled that there had been a problem with emails from the 
@clintonemail.com system being filtered out by the DoS email system, but she did not recall the specific 
email exchange. ABEDIN noted that it appeared that it was SULLIVAN's emails that were affected and 
that it would otherwise be uncommon for him to be involved in discussions about email issues. 


Email System Post Tenure 


(U//F&'89) Following CLINTON's tenure at DoS she established a personal office in New York 


bé 
b7C 


also continued to support 


(ШЖ ӨНӘ) When CLINTON'steam was forned[ — established temporary Gmail BE 
accounts for members of the team using the naming convention hrco(Qgmail [ce es been BIC 
CLINTON' qo jë DoS and ABEDIN described him as being good with technology. He set 

up the email accounts for the team so that they would have something more formal than their personal 

emails accounts. 


(U//FO't3O) When CLINTON left DoS she stopped using the clintonemail.com system and started 
using hrcoffice.com to formalize her transition. During this same time period, an outside IT company, 
PLATTE RIVER NETWORKS (PRN), was hired to maintain CLINTON's email system. ABEDIN stated 
that PRN was initially hired to manage President CLINTON мало eal It was b6 


then later decided that PRN should also manage CLINTON's email as well. BIG 
(U//FO'89) Once the hrcoffice.com system was established, CLINTON' s staff was provided email 
addresses on the new system. ABEDIN stated that! from PRN, assisted with setting 55 
с 


up new accounts for CLINTON's staff, guidance on how to use the Microsoft 


Outlook based email system. ABEDIN did not know 


(U//FO'8O) Prior to the transition to hreoffice.com, ABEDIN was advised that the 
clintonemail.com system was "going away". ABEDIN stated that she lost most of her old emails as a 
result of the transition. She had only accessed clintonemail.com through a web portal and did not have a 
method for archiving her old emails prior to the transition. ABEDIN did not know if the system 
administrator had archived the mailboxes before the system was taken down 
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(Ш//ЕӨНӨ) ABEDIN remembered having discussions with HANLEY about creating an archive of 
CLINTON's emails. ABEDIN believed that the archive was placed on a laptop so that it could be 
referenced while CLINTON worked on her book. ABEDIN did not know that the laptop was sent to PRN, 
nor did she know what ultimately happened to the laptop. ABEDIN was not aware that a copy of the 
email archive may have been placed on a thumb drive. 


Review and Production of ABEDIN Emails 


(Ш/ ӨНӨ) ABEDIN provided that she learned that DoS was seeking her emails after she read 
about it in the newspaper. DoS wanted ABEDIN's emails as part of an effort to ensure that DoS had a 
complete record of documents from CLINTON's tenure. ABEDIN contacted DoS and confirmed that it 
was seeking her emails. She noted that DoS' prior attempts to contact her were unsuccessful because DoS 
had an old email account and an old mailing address on file. ABEDIN then turned over her laptop and 
Blackberry to her attorneys so that they could conduct the review. ABEDIN was not directly involved in 
the review and relied on the judgment of her attorneys. RODRIGUEZ and DUNN stated that they sought 
additional guidance from DoS on how the review should be conducted but they never received a response. 
RODRIGUEZ and DUNN therefore erred on the side of caution and opted to include anything that they 
were unsure about. It was also noted that ABEDIN had previously responded to a similar request from the 
Benghazi Committee 


(U//FOUO) ABEDIN was shown an email chain dated April 2, 2012, with the subject “May - 
Asia". ABEDIN confirmed that the email was related to her activities while at DoS and that it would be 
considered a relevant record with respect to the DoS request. ABEDIN explained that this email was not 
produced by her team during the review because she did not have access to her clintonemail.com account 
when the review was conducted. RODRIGUEZ and DUNN stated that the request from DoS only sought 
records currently in ABEDIN's possession so they did not contact PRN to request other relevant records. 


(U//FG'8O) ABEDIN was not involved in the review and production of CLINTON' s email, in 
response to a similar request that CLINTON received from DoS. ABEDIN stated that the review was 
conducted by CLINTON's attorneys and that she was not consulted during the process. 


Private Residences 


(U//FOUO) CLINTON's residence in Washington, DC (Whitehaven) had a small office on the 
third floor that was converted to a SCIF by DoS. DoS removed the original door and replaced it with a 
metal door with a key code lock during the conversion. Inside the SCIF there was a desk where 
CLINTON worked and a computer, printer, facsimile machine and a television. DoS also installed a STE, 
a "yellow phone" and a video teleconference (VTC) system. ABEDIN provided that the door to the SCIF 
was not always locked and that ABEDIN, HANLEY and pem had 


access to the SCIF. 
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(U//FGUO) CLINTON's residence in Chappaqua, NY, was also outfitted with a small SCIF that 
had the same equipment as the Whitehaven SCIF, less the television set. ABEDIN provided that 
CLINTON was the only person to use the SCIF and that she routinely used the Cisco telephone to make 


: lar coverage was not very good there. ABEDIN, HANLEY and 
ee el had access to the SCIF. pe 
bic 
(U//F6U6) CLINTON received diplomatic pouches each night that contained the briefing 
material for the next day's meetings. When CLINTON was in Washington, she would be given the pouch 
prior to leaving DoS. If the pouch was not ready when she left, or if she was in New York, the pouch 
would be delivered to her residence by DS. The pouch would be received by the DS agent stationed at the 
house and would then be placed on a bench inside the residence. In Whitehaven, the bench was located 
outside of CLINTON's bedroom and in Chappaqua the bench was located near the main entrance. 
ABEDIN stated that it was less common for the diplomatic pouch to be delivered to Chappaqua because 
CLINTON would typically take the pouch with her when she was traveling. ABEDIN did not know if 
ever received or transported the diplomatic pouch when it was delivered to the residence in b6 


Chappaqua. ABEDIN stated а] Jdid not handle the diplomatic pouch at the Whitehaven BIG 
residence because her shift ended before the pouch was delivered at SPM 


(U//F6U6) CLINTON typically received the Presidential Daily Briefing (PDB) in person at the 
office. When she was not in the office the PDB would be delivered with the pouch or sent via secure 
facsimile, If the content was particularly sensitive she might be briefed in person by a CIA officer. 


(U//F889) CLINTON would periodically receive both secure and unsecure facsimiles at her 
residence in Chappaqua. In order to receive a secure facsimile somebody would have to answer the phone 
and then wait several minutes for the documents to arrive. Since it was a time consuming process, 

would sometimes assist CLINTON by answering or hanging up the facsimile system but he b6 
ve the documents on the machine for CLINTON or her staff to collect. ABEDIN provided that BIG: 
foe ad pick up documents from the non-secure facsimile machine, which was located in a 
separate part of the residence. ABEDIN stated that they had numerous issues with the secure facsimile 
system in the Whitehaven residence and that it was often quicker to have the documents couriered to the 
house from DoS 


(U//FOUO) ABEDIN was shown an email chain dated March 20, 2009, with the subject “Re: 
Tomorrow". After reviewing the email ABEDIN stated that she knew for a fact that there were times 
when LLL Jassisted with the facsimile machine and may have collected documents from the secure 
facsimile machine for CLINTON. ABEDIN stated that the intention was to have CLINTON do it herself, 
but she wasn't very tech savvy and would = frustrated with the process. ABEDIN provided that the team 


bé 
b7C 


would also occasionally email things t to print for CLINTON. 


Miscellaneous 
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U//FOUO) ABEDIN provided that when CLINTON needed to contact the President she would 
have| call the oval office to coordinate the meeting or call. ABEDIN believed that CLINTON 
had the President's email address but ABEDIN did not know what it was. ABEDIN noted that the 
President could only receive emails from approved addresses. She recounted that when CLINTON 
changed her primary email address they had to notify the White House so that CLINTON's emails would 
not be rejected by the server. ABEDIN was not sure how often CLINTON emailed the President. 
ABEDIN was shown an email chain dated June 28, 2012, with the subject “Re: Congratulations!" 
ABEDIN did not recognize the name of the sender. Once informed that the sender' s name is believed to 
be a pseudonym used by the President, ABEDIN exclaimed *How is this not classified?" ABEDIN then 
expressed her amazement at the President's use of a pseudonym and asked if she could have a copy of the 
email. ABEDIN provided that she did not go on the trip to St. Petersburg and noted that security protocols 
in St. Petersburg were not necessarily the same as they were in Moscow, where they were not allowed use 
to their Blackberries. 


(U//F&'8HO) ABEDIN was shown an email chain dated January 8, 2011, with the subject “Re: AG 
points from | After reviewing the email, ABEDIN provided that she vaguely recalled the email 
exchange and that the original email was sent in preparation for a call between the Attorney General and 
CLINTON. ABEDIN stated that she did not have concerns with the content because she was only a 
conveyor of the information and that she relied on the sender to properly mark any sensitive information. 
ABEDIN reiterated that she did not take it upon herself to question the sender's judgment on how a 
document should be marked. ABEDIN stated that people at DoS took the handling of classified 
information very seriously. She never had any concerns with how classified material was handled by 
individuals at DoS. Nor did she ever recall CLINTON expressing concerns over how classified 
information was handled. 


(U//FOG3O) ABEDIN first met SYDNEY BLUMENTHAL in 1996 when she was a junior staffer 
at the White House and BLUMENTHAL was a senior official. ABEDIN never worked directly with 
BLUMENTHAL but when CLINTON was in the Senate he would send emails for ABEDIN to pass to 
CLINTON. ABEDIN did not always forward the messages to CLINTON and BLUMENTHAL eventually 
stopped emailing ABEDIN when he realized this. When ABEDIN was at DoS, CLINTON would 
sometimes send ABEDIN emails from BLUMENTHAL for her to print. ABEDIN provided that she did 
not read the content of the emails from BLUMENTHAL and had no knowledge of his sources. 


(U//FO3O) ABEDIN provided that she was not involved in drafting talking points while at DoS 
The authors of the talking points depended on the content and were the responsibility of the appropriate 
bureau 


(Ш/Е ӨНӨ) ABEDIN was shown an email chain dated September 20, 2012, with the subject 
“Ке”. After reviewing the email ABEDIN stated that it was not common to stash the diplomatic pouch in 
the limousine but that it would have been secured by the DS or Secret Service (SS) agents that were with 
the car. ABEDIN noted that if they were in CLINTON's car there would be two DS agents present and if 
they took President CLINTON's car there would be one DS agent and one SS agent 
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y of the original interview notes and the NDAs signed by RODRIGUEZ, 


are enclosed in a 1A envelope. 
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(U//FOtO) On November 20, 2015| 
interviewed at the 
Special Agents (SA) 
interviewing agents, and the nature of the interview, 
information 


(U//FOUO) LLL Joined the U.S. Department of State inl e has Pe 


held the following positions 
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(U/rogo[ —  ]described the OpsCenter as the “eyes and ears" for the Secretary of 
State. The Ops Center is staffed 24 hours a day and constantly monitors reporting from Department of 


State cables, other government agencies and open source news outlets for information of interest to фк 
Department of State leadership. The Ops Center is also responsible for coordinating communications 
between senior leadership and foreign dignitaries. As a Senior Watch Officer (SWO), 
was the most senior person in the Ops Center and was responsible for overseeing the activities of the 
other personnel as they worked to identify and disseminate critical information to the Secretary of State 
and Department of State leadership 
b6 


ътс 
Investigation on — 11/20/2015 ua [ 1] 
Fie# [| ^ þe Date dictated — N/A b3 


b7E 
b7C 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency: it 
and its contents are not to be distributed outside your agency. 
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(U//FOUO) There are approximately seven or eight individuals staffed in the Ops Center during a 


normal day shift. In addition to the SWO, there are the following positions: 


• Watch Officer (WO) – The WO is typically a junior civil servant who is responsible for 


gathering important information and disseminating it to Department of State leadership as 
necessary. They are responsible for answering incoming calls, monitoring cable traffic and 


scheduling phone calls for senior Department of State personnel as necessary. 


* Emergency Action Officer (EAO) - The EAO is responsible for monitoring international 


hot spots and other current items of interest for the Department of State. They usually 
work with the Crisis Management Support team, which is collocated in the Ops Center. 


* Ops Specialist – The Ops Specialist primarily performs clerical work for personnel in the 
Ops Center. This may include sending and receiving facsimiles or arranging the logistics 


of meetings or calls for Department of State leadership 


* Consular Affairs Officer — The Consular Affairs Officer is responsible for addressing any 


matters relevant to standard consular duties at foreign U.S. establishments. 
e Diplomatic Security (DS) Officer - The DS Officer is a liaison between the Ops Center 
and the U.S. establishments and Regional Security Officers abroad 


e Swing Station – The swing station is an extra body that provides support to the SWO and 


the watch team as necessary. 


* Bureau of Intelligence and Research (INR) Representative — The INR Rep is responsible 
for acting on behalf of the INR and for liaising with the broader Intelligence Community as 


necessary. 


(U//F8UO) When urgent information or breaking news, which requires the immediate attention 


of senior Department of State personnel, is identified during normal working hours, the Director of the 
Ops Center is notified by the SWO. The Director communicates the information up the chain of 
command as appropriate. If such information is identified afterhours, the SWO notifies the Deputy 
Assistant Secretary (DAS) directly. The DAS will then provide the SWO with guidance on how the 
information should be transmitted 


(U//FOUO9) During 
the Ops Center. 
in the Ops Center, and upon 


tenure as a SWO there were two different Directors for 


departure, became the Director. 


uovo l — ëa not recall ever emailing the cl =a and had no 


knowledge of the Secretary's personal email account or private email server. only 
recalled receiving a few emails from the Secretary, such as mass emails at the holidays, which she 
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presumed were sent from a Department of State email account. In instances where she needed to relay 
information to the Secretary she would send the information to the Secretary's Chief of Staff (CoS), or to 
HUMA ABEDIN. 


(шө) i es shown a copy of the email that she sent on July 3, 2009, with 
the subject “Summary of 1055 EDT DPRK Conference Call”, which was flagged by the ICIG as possibly 
containing classified information С frecaled the events surrounding the email and 
provided that she was the SWO on duty that day and had been directed to convene a call for key 
Department of State officials to discuss the DPRK missile launches. The discussion was based on 
afterhours reporting from the Intelligence Community that was at least confidential if not classified 
ни not definitively recall what agency owned the source reporting but believed that 
it likely came from the Central Intelligence Agency a ws on the conference call for the 
purpose of taking notes but she was not an active participant in the discussion. [оша 
not recall if the call was оп a secure line but noted that it was common for such calls to be held on 
unclassified phone lines because not all of the key participants would have access to a secure phone if 
they were at home or traveling. 


(U//FEVE) Following the сї — — — — was responsible for summarizing the discussion 
in the referenced email and then forwarding it to individuals within the Department of State who needed 
to be aware of the situation. The email was sent on the unclassified system because not all of the intended 
recipients had immediate access to classified email wawus[-— —— — puel that it was not 
uncommon for the Ops Center to send such emails on the unclassified system. The specific content of the 
email was based V mme |? and her judgment on what should be included in the 
summary. There was no formal review of the email, for either its content or for the presence of classified 
material, prior to it being sent. noted that the Deputy Executive Secretary was an 
Original Classification Authority (OCA) who would on occasion review material for the Ops Center. 


(U//FOUO) The email recipients were based on an established call sheet that indicated who should 


receive reporting on various topics. Also included were individuals added by the senior leadership. 
| aerial the email recipients on the above cited email and provided the following 


information about their roles at that time: 


e [was stationed in New York at the time, [7] 


could not recall her specific position but provided that she held a high ranking function 
within the United Nations. 
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ould not recall her 
specific position or title. 


. 
. were staffers for other bureaus within 


the Department of State. 


reviewed the subsequent emails in the chain and noted that 
was the SWO on duty on July 4" Based on the time difference between when the 
conference call occurred and when the emails were sent, believed that there may have 
been another SWO, or two, on duty between her shift and shift. С foua 
not recall who relieved her at the end of her shift but stated that she would have briefed the incoming 


SWO on the conference call and any necessary follow up items that the incoming SWO would need to 
address during their shift. 


(U/FF9U9) С provided that the Ops Center maintains a Watch Log where the 
details of any call arranged by the Ops Center are recorded. The log contains basic information about the 
call to include the date, time, participants, and in some cases a brief synopsis of the subject of the call. 
The Ops Center will log any calls that are facilitated by the Ops Center, which involve the Secretary of 
State, or any Deputy Secretaries, Under Secretaries, Assistant Secretaries, or foreign dignitaries. The Ops 
Center does not maintain a log for emails sent to, or from, the Ops Center. 


(0/56) П ps amenable to recontact if necessary. 


(U//FOUO) Agent notes are included in an attached 1A. 
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(U//FEUO) On May 28, 2016, CHERYL MILLS, date of birt 
interviewed by Federal Bureau of Investigation (FBI) Special Agent (SA and SA 
rccte commer г" the law offices of Wilkinson Walsh + Eskovitz, 1900 M Street NW, Suite 800, 
Washington, DC. Present for the interview was SAMUELSON 's counsel, Beth Wilkinson, Partner, 
Alexandra Walsh, Partner, and Hal Brewster, Associate. Also present was FBI Section Chief Peter Strzok, 
as well as David Pr meum Г penes] 0 the Department of Justice (DoJ) 
Counterintelligence and Export Control Section. After being advised of the identities of the interviewing 
agents and the purpose of the interview, MILLS provided the following information 


(U//FOtJO) Immediately after completing her service at the United States Department of State 
(State) in 2013, MILLS became personal counsel for HILLARY CLINTON. HEATHER SAMUELSON 
joined MILLS' firm, located in Chevy Chase, MD, sometime in 2014. 


Transition to Platte River Networks Server 


(U//FG'8O) When the respective offices of WILLIAM and HILLARY CLINTON began a search 

for a company to operate and maintain an email server, the CLINTON's financial manager recommended 
[tee a technology broker. There were no security concerns with the CLINTON 's then- 

current email server operated by BRYAN PAGLIANO (Pagliano server). The CLINTON's wanted an 

outsourced company accountable for the operation of the server. MILLS coordinated the needs for the 
server by providing non-technical guidance ою which was focused on the end user experience. 
Ae. identified several companies as options, the Office of President CLINTON reviewed the 
recommendations and selected Platte River Networks (PRN). After PRN was selected to procure, 
operate, and maintain the server (PRN server), MILLS negotiated the final cost and addressed privacy 
concerns with PRN. Throughout the negotiation process, MILLS consulted with PAGLIANO to ensure 
the recommendations of PRN would meet the end user experience guidance she had provided to PRN 


(U//F889) When PRN completed the transition from the Pagliano server, MILLS did not know 
if PRN transferred any email to the PRN Server. Additionally, MILLS did not know what PRN planned 
to do with the Pagliano server after the transition was complete. 


Investigation on __ 5/28/2016. at Washington, DC 


rite [in Date diced NA 


This document contains neither recommendations nor conclusions of the FBI. [t is the property of the FBI and is loaned to your agency: it 
and its contents arc not to be distributed outsidc your agency. 
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Department of State Request 


(U//FOUO) In the Summer of 2014, State was in the process of producing materials for the House 
Select Committee on Benghazi and raised concerns with MILLS regarding the lack of email for 
CLINTON. MILLS met with State peivonnel= = = ee] and 

who told MILLS State had no electronic records for CLINTON, other former Secretaries of State, 
and some other State personnel. MILLS understood the issue to be that State's computer systems taped 
over backup records after a period of time for all users not on the seventh floor and some users on the 
seventh floor. MILLS suggested to State they search State systems for CLINTON's clintonemail.com 
address, while State requested MILLS produce CLINTON's email. State provided no initial deadline in 
the first meeting and followed up with a letter documenting the request. MILLS understood State's 
request to be in relation to the Benghazi Committee and not a Freedom of Information Act (FOIA) 
request. 


(U//F&8O) CLINTON asked MILLS and DAVID KENDALL to oversee the process of 
roviding State CLINTON 's emails from her tenure as Secretary of State. As the process was developed, 
ET eed MILLS it was CLINTON or MILLS' obligation to filter out personal emails from what 
was provided to State. Additionally, if State received all CLINTON's emails involving .gov accounts, 
State would not filter out personal emails. 


Collection of Relevant Email 


(U//EG9O) Late in the Summer of 2014, MILLS contacted — — — — — Jat PRN and 
requester " s email involving a .gov account from her tenure as Secretary of State. MILLS 
aa search for .gov email encompassed email headers, the body of emails, and any 
forwarded emails. She was not aware of which mailboxes or other potential gial 
searched for email responsive to her request. However, MILLS did not believe was asked 
to search or searched HUMA ABEDIN's clintonemail.com account. After preparing a .pst file of the gov 
emails (July Export) based on MILLS' request[ — — — — discussed. different options on the transfer 
of the July Export with MILLS, to include shipping DVDs, but recommended a secure 


remote transfer. Based of advice, MILLS neither requested nor received DVDs 
containing the July Export 


е After deciding on the remote wanfe[ — — 1] provided MILLS with a link 


which provided| remote access to MILLS' computer. MILLS clicked on the initial link, 
then clicked an additional acknowledgement аана TERE to remotely access her 
computer. [-——— then transferred the July Export to MILLS' computer and imported it into 
Outlook. Once the process was complete, MILLS re permission and the remote 
session was terminated. MILLS did not know where| saved the .pst file on her computer or 
if it was encrypted, however, MILLS did recall the .pst file was password protected. Sometime after 
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MILLS received the transfer, HEATHER SAMUELSON received a similar transfer from PRN. MILLS 
never made copies of the .pst file or transferred it to external media. 


(U//F8UO) MILLS' Dell laptop (Dell) was the computer that received the transfer described 
above. The Dell was primarily used for work, but was sometimes used for personal reasons, It was 
connected to the Internet and had up-to-date antivirus software installed. The Dell was not wiped, other 
than PRN actions described later, or reset to a factory state. MILLS continued to use the Dell until it was 
turned over to her attorney BETH WILKINSON. The Dell is currently in WILKINSON's possession. 


(Ц/ ӨНӨ) Shortly after SAMUELSON began reviewing the July Export from PRN, she noticed 
there was no email from approximately January 2009 — March 2009 in the data provided by PRN. 
MILLS likely reached out x regarding this matter an MILLS PRN did not 
have any email for CLINTON from the timeframe in question. Since CLINTON was using AT&T for 
BlackBerry service during that time, MILLS recalled learning AT&T did not keep email records, but did 
not recall when she became aware of that fact. MILLS did not contact any other email service providers, 
such as Gmail, because she did not have knowledge of CLINTON using another email service. 


Additionally, MILLS did not recall attempting to access an Apple server that was once in operation at the 
CLINTON residence in Chappaqua, NY. 


(U/AFOUQ) After reviewing a document dated July 28, 2014 referencing a conference call 
between MILLS, and PAGLIANO regarding archived email options, MILLS stated she did 
not recall the specific conversation. Other than the conversation described above, MILLS did not recall 
any other conversations мї Jabout the request for CLINTON's email involving .gov 
accounts. 


(U//FOUO) After SAMUELSON began the review of the July Export, but before her review was 
complete, MILLS contacted, and requested a .pst file containing all of CLINTON' s email 
from her tenure as Secretary to review it for non .gov work related email (September Export). MILLS did 
not b e search ABEDIN' s email and did not know which mailboxes or email 
addresses searched to produce the .pst file responsive to her request. PRN remotely 
transferred the .pst fileto SAMUELSON, however, MILLS did not recall if the .pst file was transferred to 
MILLS' Dell. Other than the July Export and, possibly, the September Export, MILLS did not receive 
any other .pst file transfers from PRN. However, SAMUELSON, as the one conducting the review, 


sometimes contacted directly and received smaller transfers when she identified gaps in .pst 
files from MILLS never had direct access to CLINTON's mailbox on ће PRN server. 


Cull and Review of Email 
(U//F88O) The review methodology employed by SAMUELSON was developed by 


SAMUELSON, MILLS and KENDALL, but was executed by SAMUELSON. They did not consider 
using any commercially available e-discovery tools for the review and did not consult any individuals 
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who were not agents of Clinton during the review process. They also did not discuss how to handle 
potentially classified emails during the review because they had no reason to believe any classified 
material was contained in the emails. Additionally, no emails were identified as containing potentially 
classified or sensitive information, therefore, no emails were removed during the review process. 


(П/Ж ӨНӨ) The review process called for all email from CLINTON 's tenure to be filtered for 
.gov email addresses, relevant keywords, and the names of government officials. The review took 
SAMUELSON several months and occurred at MILLS' office in Chevy Chase, MD. SAMUELSON 
used her own computer for the review and, as questions arose, SAUMELSON would print any email in 
question and ask for guidance from MILLS. Emails that contained a mix of work-related and personal 
content were treated as work related. Once the review was complete, SAMUELSON printed the 
approximately 30,000 work-related emails identified in the review. The printed copies were then provided 
to State in December 2014. SAMUELSON produced an electronic copy of the work-related emails which 
was later provided to KENDALL at Williams and Connolly. MILLS was not aware of who produced the 
electronic copy provided to the FBI or what the file was named. Other than emails where SAMUELSON 
requested MILLS' guidance, MILLS did not review the emails identified by SAMUELSON as work- 
related. 


(U//F8UO) MILLS was unsure if SAMUELSON encountered duplicate emails during her 
review. If she did, MILLS was not involved in any efforts to remove duplicates from the collection 
provided to State. Regarding ABEDIN's account on clintonemail.com, MILLS did not know why no 
email between ABEDIN's account and CLINTON's account was part of the production to State. There 
was no distinction between the treatment of email to or from ABEDIN's clintonemail.com account and 
ABEDIN's state.gov account. 


(U//FO'tJO) After State began reviewing the emails printed by SAMUELSON, Stated advised 
MILLS when specific emails were determined to be classified and instructed her to delete the emails in 
her electronic copy, then empty her deleted items folder. 


(U//FOtJO) After reviewing an email dated November 24, 2014 referencing an "urgent call” with 
“CESC,” MILLS stated she did not recall participating in a call Er AT MILLS also did not 
recall SAMUELSON having trouble with her connection to the .pst files in the same approximate 
timeframe 


(U/AFEU6) MILLS recalled a discussion with PRN where PRN explained, because of the way 
Outlook functions, it displayed CLINTON's current email address instead of the email address CLINTON 
used at the time each email was transmitted. This issue was not resolved and no emails produced to State 
were altered 


Deletion of Email 


UNCLASSIFIED//EFeuUe 
HRC-160 


bé 
bIC 


UNCLASSIFIED//F6t0 


FD-302a (Rev. 10-06-95) 


Continuation of FD-302 of. Interview of CHERYL MILLS „ On 5/28/2016 , Page 3 


(U//F9UO) In late 2014 or early 2015, MILLS сомасеё[ — — Jand requested he remove 
all .pst files from her computer. She was unsure if she discussed with PAGLIANO the software proposed 
oe effect the deletion. In January 201 5 þem MILLS a link and, in a 
process similar to the file transfer process described above, took control of her computer in a remote 
session. checked the computer for the requested files and removed them using software 
that permanently deleted the files. MILLS did not know if BleachBit was the software used by 

Pire uu After he completed the process, MILLS looked wil[ — Jto verify the files were 
deleted. MILLS did not discuss wiping or deletion software with anyone who was not an agent of 
CLINTON at the time, nor did anyone other а] remove files from her computer. 


(U//F8UO) In December 2014 or January 2015, CLINTON decided she did not want to retain 
email beyond a 30 or 60 day retention policy, to include access to any historical content. MILLS 
contacted| Jand conveyed this change, but did not specifically instruct him to remove any .pst 
files or archived mailboxes. 


(О// ӨНӘ) In March 2015, after notifying PRN of obligations to preserve materials relevant to 
CLINTON's email, MILLS contacted PRN to determine if any backups of CLINTON' s email existed 
and, if so, where those backups were located. After discussing the matter with PRN, she instructed PRN 
to visit the datacenter where the Pagliano server was housed and review it to confirm no records existed 
on the old system. PRN could not locate any backup data on the Pagliano server or any of the associated 
equipment, however, MILLS instructed PRN to maintain the equipment. MILLS was not aware of PRN 
deleting any data related to CLINTON's email in March 2015, nor did she request PRN delete any data, to 
include .pst files or Datto backup files. Furthermore, MILLS did not instruct PRN to delete any data 
using BleachBit on March 31, 2015. 


(U//F8'UO) MILLS had no knowledge regarding the following topics 


e At the time it was created, an email archive of CLINTON's email, including content from her 
tenure as Secretary of State, created by MONICA HANLEY. 

« HANLEY providing the computer she created the archive on оС еапу 2014. 

* С returning the above computer containing the archive in 2014. 

• Any transfer of clintonemail.com content to hrcoffice.com. 

e CLINTON's access, or lack thereof, to her clintonemail.com content after CLINTON' s 
hrcoffice.com email address was created. 

• HUMA ABEDIN's method for accessing email. 

e A master copy containing all of CLINTON's email from her tenure as Secretary of State. 

e PRN email exports from September 2015. 


(U//FOG€90) A copy of the original interview notes are enclosed in a 1A envelope 
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МИРО) On April 9, 2016, CHERYL MILLS. was interviewed by Special Agent (SA) 
pr SAL. inside the ЕВ! Washington Field Office. 601 4" Street NW. 
Washington, DC 20535. Present for the interview were MILLS' attorneys Beth Wilkinson. Alexandra M. 
Walsh, and Hal Brewster from Wilkinson, Walsh & Eskovitz P. Ale present was FBI Section Chief 
Peter Р. Strzok. as well as David pie ee poe 
the Department of Justice (DOS). Prior to the interview, Wilkinson. Walsh. and Brewster agreed to sign a 


non-disclosure agreement in anticipation of viewing documents during the interview that were classified 
as part of a Special Access Program (SAP) 


(U//4299) Prior to the interview. agents advised MILLS that while it was understood that the 
"view was being limited to the period of her Department of State (DoS) employment, the ЕВЕ believed 
ssential to the investigation to understand the sort process and the computers used in that process 
Furthermore, MILLS was advised the ЕВЕ expected to continue the interview after the details were 
resolved by the attorneys. After being advised of the identities of the interviewing agents and the purpose 
of the interview. MILLS provided the following information: 


(U//POtO) From 1992 to 1999. MILLS served in the White House as Associate Counsel to the 
President. From 2002 to 2009, MILLS served as the Senior Vice President and General Counsel at New 
York University. MILLS also served as a consultant to HILLARY R. CLINTON's 2008 Presidential 

Campaign. In 2009, MILLS transitioned with CLINTON from the campaign to the Department of State 
(DoS). Initially, Irom January 2009 until May 2009. MILLS served in a part-time capacity as Acting 
Chief of Stalf. She converted to full-time Chief of Staff and Counselor for Policy related to Food Security 
and Haiti thereafter. MILLS resigned trom DoS in February 2013. 


aped HUMA SE DIN and JACI OB SULLIVAN were also part of CLINTON'S DoS 

i alf for Operations and SULLIVAN served as 
was also assigned to CLINTON’ cutive stalf as 
position was separate from that of the 


Investigation on ОООО zd Washington, D.C. E Е 


this document contams neither scommendations nor conclusions of the FBI. It is the property of the ЕВЕ and is loaned to sour ig 
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(C/OH) MILLS held a Тор SecrevSensitive Comparimented Information (SCH clearance 
while at DoS. MILLS believed she likely had security training from Diplomatic Security (DS) upon 
receiving her clearance. but didn't recall any specifie training. MILLS was not aware. nor was she ever 
told. she was a DoS original classification authority. 


(OPO) MILLS did not recall receiving any specific training or guidance concerning Federal 
Records retention policy or procedure during her DoS tenure, but explained it could have happened. 


(ӨБӨ) MILLS’ unclassified 008 email account was MillsCDe'state.gov. This account was 
linked to her DoS issued Blackberry and could also be accessed from her unclassified DoS computer or 
remotely via a lob system. MILLS further stated that the DoS ff si s not always reliable. and 
sometimes "went down." MILLS maintained a Gmail aou that she would 
use when she could not access ified account. Said Gmail account was the only personal 
account used by MILLS during her DoS tenure. 


(UFO MILLS was able to switch over to a classified network іп her DoS office. She was 
unsure as to what level of classification said network could handle, but knew that it could at least handle 
material declared as Secret. 


(ША ӘНӘ) When MILLS needed to review Top Secret materials, information was provided to her 
in person and taken away after she reviewed the materials. MILLS was not familiar with the JWICS 
system, and was not sure who may have had a JWICS account at DoS. 


(UA POR) MILLS was asked to review an email dated 6/4/2011 and with the subject line 
"Google email hacking and woeful state of civilian technology." In response to the email, MILLS stated 
she did not recall the email, but the content was not unfamiliar to her. MILLS remembered hearing that 
hackers may have been targeting Gmail accounts, and further recalled somebody sugge; nt 
m ve been targeted, but she was unsure of who provided her with this information 
[oan the originator of said email. traveled a lot and had frequent difficulties signing into the 


DoS network, so it was common for her to use personal email. 


(U//E49) Agents asked MILLS to review a DoS cable dated 6/28/2011 with the subject line 
"Securing Persona mail Accounts." MILLS did not recall the cable, but stated that it was probably 
connected to the 6/4/2001 email she previously reviewed. MILLS did not believe the referenced cable 
resulted in a “perfect” change of behavior in regards 10 the use of personal email accounts by DoS 
employees. 


(UFO) MILLS was asked to review an email dated 7/22/2011 with the subject line "Draft 
Hig! vel Narrative and Work Plan [Note Use of Personal/Gmail]." MULLS stated she "did not recall 
what she meant by (writing) ‘Note Use of Personal/Gmail." in the subject line. 
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(ugreuo) only mobile DoS device MILLS was issued was a Blackberry. Most, but not all. 
people at DoS ме igned a Blackberry. MILLS was not assigned a mobile sccure phone, but she was 
able to check one out trom the DoS communication team if/when needed. 


(UFOO) MILLS did not travel with CLINTON as often as ABEDIN and/or SULLIVAN, 
MILLS only traveled with CLINTON on occasion when she visited Caribbean. African, or South 
American countries. When CLINTON traveled. MILLS ordinarily stayed back in W: gon. DC, to 
manage DoS in her absence. MILLS recalied receiving travel briefings from DS prior to her DoS related 
travel 


(UFO) MILLS was involved with the team that helped CLINTON transition to DoS. MILLS" 
tole was to help CLINTON identify the priorities she wanted to address as Secretary. MILLS also 
identified individuals for CLINTON's staff. MILLS further saw her role as helping CLINTON “balance 
her lile in regards to the transition." MILLS had no recollection of being involved with discussions 
concerning the structure of CLINTON's Information Technology (1T) platform during or after the 
transition. 


(UPOO) Agents asked MILLS to review two emails from February 2009 with the subject lines 
"Update" and "Recap - Meeting re: Blackberries.” While MILLS did not recall the specific emails, she 
stated she recalled the issue the emails referenced. MILLS explained CLINTON used a Blackberry to 
communicate prior to coming to DoS. CLINTON was not computer savvy and thus was not. accustomed 
to using a computer. so efforis were made to try to figure out a system that would allow CLINTON to 
operate as she did before DoS. CLINTON did not have a computer in her DoS office. MILLS recalled 
hearing that the National Security Agency (NSA) had secure Blackberry technology that would allow lor 
the use of such devices in a SCIP. MILLS requested DoS communication and security personnel research 
the possibility of implementing said technology at DoS. Ultimately it was decided that although the 
technology ted. it was not feasible to implement the same technology at Dos. 


(WESH) When asked what her understanding was in regards to who the six proposed secure 
Blackberry users were at Dc relereaced in the email, MILLS explained that the goal was to obtain the 


technology for CLINTON because she did nol have a computer. MILLS was not aware of who else at 
DoS may have received a secure Blackberry had the technology been approved for use at DoS. 


(U//FG89) The ative suite at DoS was termed "Mahogany Row.” because of the wood 
paneling throughout Lhe space. Mahogany Row a SCIF. so the use of Blackberries was not 
authorized. MILLS was not familiar with waivers issued to previous Secretaries of State. which allowed 
Tor use of Blackberries in a DoS SCIF. 


sked to review a March 2009 DoS Memo with the subject line “Use of 
Phe memo, from ERIC J. BOSWELL, was addressed to MILLS 
MILLS believed the memo was in 


(ESHO MILES wi 
Blackberries in Mahogany Row 
MILLS stated she “did not recall the memo. but it was not unfamiliar. 


=> — — 
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response to inquiri Е ns held early on in CLINTON's DoS tenure concerning the possible use 
of Blackberries in sensitive DoS spaces. However, MILLS further explained thai CLINTON and her 
executive staff did not use Blackberries on Mahogany Row because they were never authorized to do so. 


Continuation of FD-302 of 


(OFS) When CLINTON wanted to email, she would have to leave Mahogany Row to 
retrieve and use her Blackberry. When CLINTON was inside of DoS Headquarters. most information 
was relayed to her fave to face or on the phone. CLINTON also liked to receive and read a lot of 
information in paper documents, which is why she would often forward emails to her executive staff with 
instructions 10 print. MILES was not aware of anyone other than CLINTON who had access to 
CLINTON's email account. 


(UFRR MILES was not aware of CLINTON ever being issued а DoS Blackberry. nor could 
she recall any official request made for CLINTON to receive опе. Agents asked MILLS to review an 
email dated 8/50/2011 with the subject line "Communications." After viewing the email, MILLS stated 
that she believed the exchange was in reference to conversations about communication issues during 
Ifurricane Irene. MILLS recalled CLINTON's email was down during that time. Agents asked MILLS 
what was meant in the email by discussing the creation оЃа DoS email account that could “mask her 
identity, but which would also be subject to FOIA reques: MILLS explained she assumed “masking 
her identity" was in reference to the ability to give CLINTON a pseudonym so her account was not 
obvious to outside parties. MILLS also explained she thought that the FOIA reference meant that 
CLINTON's emails Irom the potential account would be subject to FOIA if the filing party knew the 
pseudonym. 


(U/ POH Agents asked MILLS to review an email dated 1/24/2009 with the subject line “Series 
of Questions.” MILLS stated she recalled the context of the email. As MIT.LS previously mentioned, 
CLINTON did not know how to use a computer, so the suggestion of a stand alone computer for 
CLINTON was not an appropriate solution. 


(FOH) CLINTON's office was connected to MILLS’ office. so she would generally walk into 
CLINTON’s office to share information MILLS received from relevant emails. MILLS wanted to create 
the best Now of information to the Secretary possible. MILLS stated she had no general concerns on how 
1005 business was handled on unclassified systems. 


(UEO When e LINTON first came to DoS, she was using an email account associated with 
her AT&T Blackberry (hy Косту ре). and а few months later. CLINTON transitioned over to 
‘clintonemail domain. MILLS did not know why CLINTON transitioned. but was aware of the 
ion because she was notified of the change in CLINTON's email address. MILLS further stated she 
was not aware of anyone at the time. from DoS or otherwise, who was responsible for the email transition. 


(UZ Per) [twas MILLS' practice to use her State.gov email when conducting DoS business. 
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(ЖӨНӨ) MILLS was not aware of any efforts to archive emails for federal records retention. 

requirements or otherwise while she was at DoS. MILLS may have had conversations with BRYAN 

PAGLIANO concerning the Federal Records Act, but she was not sure. MILLS met with PAGLIANO 

frequently. MILLS did not recall any conversations wih[ озш ine 

CLINTON's use ofa private server and/or the Federal Records Act. MILLS stated that 

name was familiar. but she did not recall any interactions she may have had with him. 


(ОРЫ) MILLS recalled CLINTON using an iPad to review news articles. MILLS did not 
know if CLINTON used her iPad to email. MILLS was not aware of how many iPads CLINTON may 
have had during her DoS tenure. MILLS did not recall CLINTON using a “flip phone." MILLS was only 
aware of one mobile phone number for CLINTON. 


(U//FOUO) MILLS did not recall any temporary email accounts or phone numbers being set up 
Гог CLINTON during Hurricane Sandy. 


(ӨБӨ) MILLS did not learn CLINTON was using a private server until after CLINTON's 
DoS tenure, MILLS stated she was not even sure she knew what a server was at the time. MILLS had no 


insight as to who came up with the idea of using the private server. nor was she aware of who made the 
final decision to use sai However. MILLS believed the idea was to “piggyback” on the already 


Nisting server being utilized by President WILLIAM J. CLINTON. MILLS stated that there may have 
been technical people at DoS who were aware the Secretary was using a private server, but MILLS was 
only speculating. MILLS was not aware of any DoS procedures to approve the setup and use of a private 
server by CLINTON. 


(U/9UO) ABEDIN also had an account on the clintonemail.com domain. MULES was not sure 


(she) did not have one.” 


(LAPOS) MILLS was not familiar w 
stated she was "not aware of the email account 


need to maintain federal records. Agents asked MILLS to review an email dated 12/11/2012 with the 
subject "Significant FOIA Report." After reviewing the email. MILLS stated she was not sure if she was 
involved in the FOIA request filed by Citizens for Responsibility and Ethics in Washington (CREW) as 
ssed in the етай. MILLS further explained there was a large volume of FOIA requests while she 
at DoS. DoS Executives were aware of significant FOIA requests. but it was not typical for 
MILLS to respond to FOIA because “it was not in her realm." MILLS also stated she "couldn't say who 
(at DoS) FOIA responses fell on.” 


«+ 
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Continuation of FD-302 of interview of Chers! Mills. ‚ On £H/09/2016 , Pag 
(UFOO) MILLS did not have knowledge of any backups or migrations of clintonemail.com 

accounts, nor was she aware of who might have knowledge of such events. MILLS was not aware of any 

emails being deleted or wiped from CLINTON'’s private email server prior to CLINTON leaving DoS. 


(U//F8UO) Agents asked MILLS to review an email dated 10/13/2012 with the subject line “This 
am Green on Blue.” After reviewing the email, MILLS stated she remembered the event, but not the 
specific email. MILLS did not know r^ appa Pe have forwarded her the email in question, but 
assumed it was "because he wanted her to read it." MILLS also noted the email was sent on a Saturday, so 
she was probably not in the office to receive the information directly from| MILLS further 
stated she did not have any concerns over the classification of the content of the email. nor that it was sent 
via an unclassified email. 


(U//FOtiO) Agents asked MILLS 10 review an email dated 2/20/2011 with the subject line 
tated she did not recall the email, nor 


"Follow Up to Davutoglu С After reviewing the email, MILLS s 5 ail, 
could she speak as A ane P666 for drafting the email and sending it to her. MILLS 
further explained if the media was interested in a story related to DoS would have notified 
MILES regardless of the sensitivity. 


(ЖӨНӨ) Agents asked MILLS to review an email dated 3/1 ed 1 wi 
Eaton - Hu Alter reviews ena ү MIL. LS stated She was 


MILLS stated shes 
what she meant when she typed “sending for info not for forwarding" before sharing) 
with CLINTON. MILLS had no concerns over her decision to forward the email on to 
PHEN MULL. or CLINTON. 


Iq VERS MILLS recalled being read into Special Access Programs 


during her DoS tenure, but did not recall the specifics concerning the SAPs or read-on proc 


MILLS stated she was "not surprised to see an email like this." She further stated that 
nothing in the email concerned her in regards to its classification. MILLS was not sure why| 
would have sent the email string to MILLS' Gmail account rather than to MILLS! DoS account. MILLS 
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further stated she did not recall if it was common to receive emails similar to the email in question in her 
Gmail account. MILLS was not aware of a formal process for providing notification of concurrence 
related to a High Value Target (HVT) to DoS Headquarters. 

(U//FO'85 Agents asked MILLS to review an email dated 12/27/2011 with the subject “(SBU).” 
After reading the email, MILLS stated that she had no concerns regarding the classification of the email $6 
and her decision to forward CLINTON the email she received P SENE) MILLS explained the bc 
goal was to observe what was going on in local media at the time, and she believed the email was related 
to that purpose. 

gents asked MILLS to revie' i 

with the title and another dated[ — — ]with the title| The first oi 
the two emails was sent on the DoS Secret netwo; 1 docu was sent via bl 
unclassified DoS email. Both emails pertained t MILLS b3 


stated that she did not recall the originator of the document| nor did she 
remember the email, nor how the information contained in the emai! would have been relayed to 
CLINTON. At the prompting of her counsel, MILLS also stated she received between 400 and 700 
emails a day while at DoS, and thus could not remember specific emails. MILLS stated she could not 


confirm if the information contained in the email agents asked her to review would have been relayed to 
MILLS did not have 


any concem over the content of the information in the emai! being sent on an unclassified system. 


(U//FO99) MILLS was involved in the development and draft process of some DoS policy 
memos, but it depended on the topic. Agents asked MILLS to review two of the same email dated 
10/4/2009 with the subject “Draft Holbrooke Team” and an attachment titled “Pak Paper 10- 
03dcjjs.docx." One of the two emails was redacted by DoS in response to FOIA production, whereas the 
other was shown in an non-redacted format. MILLS stated she did not recall the information contained bé 
in the email she reviewed. MILLS did not know who would have drafted the memo. MILLS stated she bc 
was not familiar with the LL Repo" 


(U//FOG99) According to MILLS, something might start in an unclassified format at DoS, but later 
be reclassified at a higher level when that information related to policy matters. MILLS was not sure who 
at DoS made the determination to change the classification. 

(U//FOU9) MILLS did not recall any instances wherein she had concern over the way sensitive or 
classified information was handled at DoS. MILLS aiso did not recall any instances wherein CLINTON 


shared (with MILLS) any concerns over the way sensitive or classified information was handled at DoS. 


(U//F8G'8O) A copy of the original interview notes is enclosed in a ІА envelope. 
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(U//F8'8O) On February 1, 2016, STEPHEN D. MULL, DOB. was interviewed by 
Federal Bureau of Investigation (FBI) Special Agent: lan: in his office 
at the United States Department of State (DoS), 320 21” Street NW, Washington, DC, Room 3417A 
After being advised of the identities of the interviewing agents, and the purpose of the interview, MULL 
provided the following information 


(U//FO9O) MULL is a career DoS Foreign Service Officer. From 2009 until June of 2010, MULL 
served as a Senior Advisor to the Secretary of State on Political Affairs. In June 2010, MULL was 
appointed DoS Executive Secretary, a position in which he served until October 2012. 


(U//F8G8O) MULL later served as the United States Ambassador to Poland from November 2012 
until September 2015. Thereafter, MULL was appointed to his current position, Coordinator for Iran 
Nuclear Implementation 


(U//FO'UO) As Executive Secretary, MULL oversaw the entire DoS Executive Secretariat in 
regards to information processing, crisis management, travel support, and Information Technology (IT). 
MULL was more specifically tasked with overseeing the formal processing of information to and from the 
Secretary of State, HILLARY CLINTON, and her executive staff, to include the DoS Operations Center. 
This also included providing both mobile and in office IT support to the Secretariat. 


(U//FG'U9) While serving as Executive Secretary, MULL had very little direct interaction with the 
Secretary of State. MULL mostly interacted with the Secretary' s Chief of Staff (COS) CHERYL MILLS. 


(О/ЕӨЫӘ) Everybody in CLINTON's front office, except CLINTON herself, was on the 
Principal Officer Electronic Messaging System (POEMS) system. MULL communicated with 
CLINTON's executive staff via POEMS. MULL was not aware how messages sent to CLINTON's 
executive staff were relayed to CLINTON, but assumed they were orally briefed. 


(U//FO89) MULL was aware CLINTON was using a personal email account while at DoS. 
However, MULL had no role in setting up or maintaining CLINTON's personal account. MULL stated 
he did not know if the use of personal email accounts was common practice for previous Secretaries of 
State. MULL was not aware of a DOS policy at the time prohibiting the use of personal email accounts or 
servers. MULL further explained as Executive Secretary, he was responsible for overseeing the formal 
communications of the Executive Secretariat, but would not have been involved with providing and/or 


Investigation on — 2/1/2016 ai Washington, D.C. 


rich [| ^ [e Daie dictaied — N/A 
sy ]s —— 1 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency: it 
and its contents are noi to be distributed outside your agency. 
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maintaining information communication platforms. MULL did not know who assisted CLINTON in 
setting up the private email account and server she utilized at DoS. MULL did not know who was 
responsible for maintaining CLINTON's personal mobile communications devices, nor who was 
responsible for making sure the installation and use of said devices were within DoS policy 


(U//FO99) Early into CLINTON's tenure as Secretary, MULL recalled being contacted by either 
MILLS or HUMA ABEDIN who asked about the possibility of the Secretary using an iPad to receive 
communications in her office. MULL recalled following up on their iPad inquiry, but explained he 
believed it was ultimately decided that CLINTON could not have the iPad in her office because of 
restrictions associated with her office being a Sensitive Compartment Information Facility (SCIF). 


(U//F&'UG) MULL never observed CLINTON using a mobile device in her office, but recalled 
seeing a picture of CLINTON using her Blackberry device on her DoS plane. MULL was unaware if 
there was any prohibition concerning the use of a Blackberry on the DoS plane. 


(U//F&U9) MULL assumed Bluetooth capabilities were disabled on DoS issued mobile devices. 
MULL was not sure if CLINTON's private devices were configured the same way. 


(U//FOGUO) Agents asked MULL to review an email titled “S Communications," dated 8/30/2011, 
wherein it appears MILLS and ABEDIN ask MULL about the possibility of the Executive Secretariat 
issuing CLINTON a DoS Blackberry to use while her personal Blackberry was malfunctioning. MULL 
recalled informing ABEDIN and MILLS that while the Executive Secretariat could issue a DoS device, 
the DoS issued Blackberry would be subject to FOIA requests. MULL further recalled it was eventually 
decided CLINTON no longer needed the DoS device, and thus her request for a DOS Blackberry was 
never fulfilled. 


(Ш/Ж ӨНӨ) MULL recalled receiving information from DoS Security. Д] 
sometime in 2011, indicating there was concern over the possibility that some personal email accounts of 
DoS employees were hacked. MULL specifically recalled hearing CLINTON's Deputy Chief of Staff 
(COS) JACOB SULLIVAN's personal email account was amongst those сотртотіѕей js 
currently assigned to the U.S. Embassy in| 


(U//FOUO) MULL also provided the following names of individuals at DoS who had knowledge 
of CLINTON's IT setup during her tenure as Secretary of State: 


аса who worked under MULL мате] 


for the Secretary and her executive staff. 


(U//FOUO) TULINABO (TULI) MUSHINGI was the DoS Deputy Director for Administrative 
Support and supervised the DoS Mobile Communications Team. MUSHINGI is now the United States 
Ambassador to Burkina Faso. 
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(U//FOt3O) JOHN BENTEL managed the DoS POEMS system. 


(U//FG'89» A copy of the original interview notes are attached in a 1 A envelope. 
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was interviewed at his office at The 


by Federal Bureau of Investigation 
After being advised of the identity of. 
provided the following information: 


Washington, D.C mobile telephone numbe 
(FBD) Special Ager SAL an 


the interviewing agents, and the nature of the interview. 


mosol beves er nets 


Department of State, under the former Secretary of State HILLARY CLINTON, from фай 
the end of CLINTON's term in February of 2013 is a self described “Clintonista.” His 
relationship with the CLINTONS dates back to} 
lunder President Clinton. In 2009 


(U//F889O) As the} held a TS/SCI clearance 


Department of State matters. to generate unclassified 
talking points and responses to This process often required the team 
to reference classified reporting to ensure that they had the proper context when formulating the response. 
The talking points were generated on the low side and were often based on reporting from the relevant 
country desk officer. Desk officers were responsible for coordinating information with external agencies 
as necessary, and were knowledgeable in how to protect sensitive sources and methods within their 
reporting, 


(U//F889) Composing unclassified talking points required a continuous and conscious effort to 
evaluate if a given piece of information was derived from a classified or unclassified source 

described this process as an ongoing dilemma that they had to work through — How do you talk about 
diplomatic conversations in the public sphere without getting into details that may be confidential or 
protected? However, he noted that, they had grown up in this environment and knew how to separate 
classified information from unclassified statements. mama О that he and his team had 
received training on the handling of classified information. 


Investigationon.— 11/03/2015 at Washington, D.C. 


Fic # 4 фо Date dictated __ N/A 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency: it 
and its contents are not to be distributed outside your agency. 
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(U//FOUO) 


with CLINTON and would meet with her four or 
five times a day to ensure that| ere consistent with 
the thoughts and statements of CLINTON. initially traveled with CLINTON and then when 
she became comfortable with the position he stopped traveling to manage his team in Washington D.C. 
would typically communicate with CLINTON via the Ops Center when she was traveling 
described CLINTON as a “paper person" noting that she preferred paper documents over 
electronic communications but he would email CLINTON when necessary. In these instances he would 
usually send the email to CHERYL MILLS who would either forward the message to CLINTON or 
respond on her behalf. On occasion he would email CLINTON directly. did not receive any 
formal guidance on what, or when, to email CLINTON directly. This decision was based on his 
judgment. 


worked very closel 


qurege) inthe recent CLINTON 
email releases, many of which were related to the posting of diplomatic cables by Wikileaks in 2010. In 
April of 2010] fst began to get a sense of Wikileaks asi 
Defense information. Then in November of 2010 he was notified by| 

hat the New York Times was preparing to publish a large number of diplomatic cables in 
conjunction with a Wikileaks release. Over the next several month = == bad regular contact with 
ud cara ear 
released. Upon receiving a media inquiry or a notification of an upcoming release, 

ould review the cable(s) in question and then make requests to the media outlet(s) to omit or redact 
specific information that was deemed sensitive for operational or diplomatic reasons. These requests 
were not always honored and —— estimated that they had a .250 or .300 batting average. The 
Department of State had a rule by which they would not discuss any classified information in the cables 
but in instances where the cable was being incorrectly portrayed, or could easily be misconstrued by the 
reader| would rovide additional unclassified background information to set the proper 
context for the cable. —- y worked with MILLS, and any agency that had an equity in 
the specific cable, to formulate the response to the media outlet. 


(U//FG989) Wikileaks, and other media leaks, posed a difficult problem for the Department of 
State because the information was already outside of the control of the Department of State and was often 
about to be published. While the Department of State could say nothing in response to a media 
notification or inquiry, the stance of the Department of State was to play defense and try to limit the 
potential damage by engaging the media outlet and providing a justification for why sensitive information 
should be omitted or redacted. 


(U//F8UO) [|ы became aware of CLINTON's private email account when he 


received an email where “H” was the sender. He initially thought the email was spam but upon reading 
the message quickly realized that it was from CLINTON. Aside from the ambiguous username, 
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was not surprised that CLINTON was using a personal email account because it is а common 
practice within the Department of State. С ]had no knowledge about the setup of CLINTON' s 
private server but assumed that Under Secretary PATRICK KENNEDY and MILLS would have been 
involved in that process. 


(U//Fe86) С þa no concerns about how CLINTON handled her communications 
during her tenure as Secretary of State. Nor ddl have security concerns about anybody on 
CLINTON's team. He did not recall any instances where classified information was intentionally sent to, 
or from, CLINTON's email account. However, with respect to the emails on Benghazi, he noted that in 
hindsight some of the content should have been classified even though they did not believe it was 
classified at the time it was sent. 


) Due to the sensitivity of the matter, the interviewing agents verbally requested that 
keep the interview and the nature of the discussion confidential erbally 


agreed that he would not discuss the interview with other parties. 


queso һә amenable to recontact regarding this matter, if necessary. 


(О// ӨНӘ) Agent notes are included in an attached 1A. 
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being advised of the identities of the 


retired from Department of 


and described him as a “big head.” 

did not know bis lane, specifically concerning his 
sent a weekly report directly to the Secretary of 
with the Secretary, E e ss 


U тже: ИШИН not get af 
further explained he thought 


зуе у updates to DoS Headquarters 
when it was widely known “you didn’t 


Bo ca there were co 


tact with the 
using à personal email 
nor that she was operating off a private emat server while she was Secretary oU 


needed to relay à message that required the attention of th: 1 
and a main 


would follow the chain of 
DoS contact at that level was 


bl 
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Pes 


bl 
& HAAS 


ъв 
b7C 
Я _ Зай. Page 8 y 
undersiood any emails he sen or other contacts at DoS 
€ did not recall ever copying JACOB SULLIVAN, HUMA ADEDIN, or CHERYL b6 
MILLS. on emais nate they were not in his chain of conanand. For urgent mailers, bic 


would follow proteco and contaet the necessa 


y parties via the DoS command center. 


recalled communicating directiv м] b6 
priur to Secretary CLINTON's visit to Kazakhstan m 2010, pic 


210, but that ihe only 
v he count recall going outside of his normal command channels. 


bl 
b3 
had access to both DoS unclassified and secret networks at the Embassy in b6 
He cout not recall if he had access to JWICS of a top sceret network, but stated he did not ase a b7C 
secret network. 


fo review an email dated 
A fier reviewing the email. 

mat wherein he types, “My high side 
explained it wasn't common for the high 
ometimes happened. He further explained alternative opüouns for 
ied information Bici мус been à secure 
mmary Jike this on 


dih the subject 
Jaughed and з 
T summarzing this on this system.” 
down at dte Embassy, but 
сше сїз 


kc ei 


down, so 
de to 


bl 

sons Center oF “a BS. 
sama Din Laden (UBH) 
further stated the ema 


7 However. he was not concerned about the 
as usual" for he and otbers to have to communicate sen: 


i was 
email because ji was j 


ist 


never received formal guidance wit how to communicate inform: 


however, fe stated that "i you are 


ion concerning 


a professional. sou know how io do it and how much fo do. 


bl 
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fey, Hos, 


Pontis 


Agents asked 


bl 
ed were aware лет > he dud no b3 
concerns with sending Tix miomuton contaiued in the email ever an unclassified network because 
believed he dratted the email so that it did not contain specific sensitive details, 
After reviewing the email. 


Agents asked to review an email dated 
ter reviewing the email, exclaimed “again, bl 


did not recall the specifies concerning the context of the b3 
amai au pau sere no details contained in the email that would compromise a sensitive program. 

also pointed out that there were only three people involved in his originai email. 
Agents asked ан email dated 


Afer reviewing the email] stated that the 
Pakistan closed on horder crossings jhanistan, dwing 


ТО 


io review 


Agents а] to review an email dat 


Agents noted that the email was sent on a classilie 
БАЧОК d stated that be sent the аттан on the Secret 
network because it was still during working hows in Washington, DC. compared to the previous emails 
he viewed that were sent after hours, and it made more sense for accessibility. The right method of 
sending a communication. according to баз whalever method allowed for the fastest 

киинип of the message. According td the SECRETZNOFORN marking and 
uil he reviewed were automatically inserted as а default. 


[Agents а skedL_ ]o review an email dated 


rine sirike kiits 4 mititant in Pakistan." 


noted that [sent the news. HN and further. арый id that she was 
s "sticking her nose in where it didn't belong.” noted the infonnation he added to the 
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Date of transcription 02/08/2046. 


U/POHS) On March 10, 2016 former 

was interviewed by Special Agent (SA) ind SA inan FBI 
office in New Y: LY After being advised of the identities of the interviewing agents and the purpose 
as + the following information: 


of the interview | 


(UAOO. 
Prior to his tenure 


a non-government organization (№ 


(L//E999 During his Department of State (DoS) tenure. had very limited interaction 
with the Secretary of State] assessed he likely only 
Secretary HILLARY R. CLINTON in person on six occasions. These contacts occurred when] 
traveled back to Washington. DC. for various meetings. or when the Secretary visited} 
further assessed that ae the same time period he only spoke with Secretary CLINTON via telephone 


on two 10 three occasions also participated in monthly Secure Video Teleconferences (SVTC) 
with the Secretary. 


шене] was never in direct emai act with Secretary CLINTON and did not 
know Secretary CLINTON's email address. VAR MAP needed to relay a quick message back to 
DoS Headquarters. he would generally email direct with Deputy Secretary of State JACOB SULLIVAN 
or the Special Representative to Afghanistan and Pakists уш: i icis. 
included RICHARD HOLBROOK 
and lso sent a regular Secret cable to Secretary CLINTON onc: 
week. On rare occasions, ma emailed the SRAP office or SULLIVAN via unclass 
email to alert them to a cla: 


was not sure how information he provided was briefed 
to Secretary CLINTON, bui assumed the SRAP would brief at the level they saw fit." 


Investigation an 03102016 at New York, NY 


Hay document contains neither recommendations nor conclusions of tie FIBI. R is the property of the FRL and rs loaned to sour agenes. it 


arid tly coments ate not to be distributed outside your agency. 
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- А b6 
(UFOO) There were three main мау: Јеоша report information back 10 DoS ъ7с 
Headquarters: 
ү. Cable b6 
2. Classified email — usually for lateral information to other Ambassadors or to the National bye 
Security Council and 
3. Unclassified email — for day to day interaction bl 
b3 
/ICS or a Top Secret км] b6 
b7C 
bi 
b3 
bl 
b3 
bil 
b3 
bil 
b3 
bl 
b3 
еб — — ы 
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FD RES )0-6-95) 


nien o On ЗЛОСТЬ, Page 3 


was asked to review an email with the subject 
Jpon reviewing the email, commented “wow... ] don’t recall this 


M surprised t0 see it and prefer not 10 comment.” 
is subsequently asked to review seve: emi[| — ] 
Upon reviewing cach document. again indicated he did not 
want to comment. 
(l иен ае that the reference 20261 in referenced осите Траса 


to “talking points" for foreign government discussions. also explained the "SBU" caveat in the 
emai! meant “Sensitive but Unclassified" was a selected classification option in his unclassified email. 
Other classification options included “U™ for unclassified. or “LU/SBU” Limited Use/Sensitive but 
Unclassified." 


(UFOS? While being escorted to the elevator by $А[ pud he recently 
read а news article about the investigation inta Secretary CLINTON's persi email server that opined 
that most of the classified documents were over classilied. Bees  - e that after seeing 
the above referenced documents, he now understood why people were concerned about this matter. 


ema chain, 


(ФӘН) A copy of the original interview notes is enclosed in a 1A envelope. 
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Date of transcription _ 


VAP) On April 25. 2016) оцет 
Ei. interviewed by Special Agent (SA) and SA e FBI 
Washington WFO). 6 mS /. Washington, DC 20535. Also present for the 
КМАТ Каори ud | 


interview v counsel, 

p Deparipent of Justice (D! S BIGPVIEW was conducted as a follow up to an interview of 
A by SA nd $А[ Jon March 10. 2016. Prior to the interview 
agreed to sign a non-disclosure agreement in anticipation of viewing documents during the inter 


ew thar 
lied as part of a Special Access Program (SAP), Alter being advised of the identities of the 
interviewing agents and the purpose of the interview, provided the following information 


Investigation on 3/tu/20t0o at Washington, DC ae ae UR 
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bi 
b3 
bl 
b3 
nly relayed information to individuals: bi 
at DoS Headquarters at high levels “on the 7^ floor" (a Н ference to the DoS executive suite referred to as b3 
Mahogany Row). As an alternative to uncla; stated he has access to both DoS 
classified стай, and cable system However Jie process forsendi i i ick 
That he tried to use his best judgment. 
10 review an email а] 
Pakistanis were seeking an apology lor a November 2011 event m DH S. Special Operations зш bl 
ihe Pak stani border and ilies Pakistani border gua b3 
aiso explained the "(SBU)" reference in the subject line of the email 
related to one of two sensitivity choices available in the unclassified DoS system: Unclassified or 
Sensitive But Unclassified (SBU). used SBU when he “wanted to point out that while 
something was unclassitied. it should still be treated as sensitive.” 
bl 
vents asked о rev iew an email date b3 
with the Tni wwe] re vas 


Jed networ ays sent] 
and before the NATO Summit. did not recall the specific email, but remembered 


conversations around the time regarding attempts to persuade the Pakistani's to lift the supply route ban 


Pt — — " 


b3 
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FDO (Rev 10 b3 
b6 
Continuation of FD-302 of _____Imerview 4 1] ‚Оп 04/25/2016. Page 3 PC 


у communicz i i i Pakistan (SRAP). 
and ut assumed he m 

have also wanted to SULL N 10 Know. as he noice was one OF the recipients. ү | BI 
assumed SULLIVAN would relay informatio) Jo пуопе at DoS who needed to know Ч be 
Secretary of State, Deputy Secretary of States, ete. SULLIVAN was not given guidance on how to тејау 
such information back to DoS Headquarters, but stated the email in question was sent at a time wherein it 
mportant to report. was not sure why he chose to send the email in question on a 
ed network. 


Agents asked iyiew an email dated 
12/27/201] with the subiect YSBU).” After reviewing the email explained he did not recall 
the context. However, stated that the previously explained "cross by бс] s place i 
ihe e " s L Em 
b3 
Sd o review an email dates (2012. 
with the subject “US drone strike kills ili i kistan.” Alter reviewing the email, 
explained the emai 3 se The email originated (rom an AP article found 
and forwarded to ti d icle to the Deputy bi 
AUS AD EE 


that at the time he sent 
the email. he did not think the information he provided jeopardi rone involved. 
who was Ce'd on an email in the exchange was the for the U.S. in Pakistan. 


(ОЛ ӨНӨ» А copy of the original interview notes is enclosed in a ТА envelope. 
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Daic of transcripiion _ 12/11/2015 


(U//FOtO) On December 11, 2015 


U.S. Department of State, was interviewed by Federal Bureau 
of Investigation (FBI) Special Agents — being advised 


of the identities of the interviewing agents, and the purpose of the interview, rovided the 
following information 


where she was responsible fot 
She assumed the role whe: left the position. On a typical day 


ould meet with the then Secretary of State HILLARY CLINTON at the daily 8:30 A.M. 
meeting to discuss key issues| During the meeting CLINTON 
would provide guidance on what should be communicated Prior to finalizing 


the briefing material ^ would then work with the relevant Department of State components to 
verify the message and to add any necessary details. did not deal with the U.S. Intelligence 
mmuni: 1 ide from ily interagen: 


CLINTON on all of her foreign trips, during which] 
deputies. 


were handled by one of 


(шж өнө]  Jstated that she saw CLINTON frequently throughout the day and as a 
result most of her communications with CLINTON were арай onl: time 
when CLINTON emailed her directly and that was on the night of the Benghazi attack stated 
that at that time she had no knowledge that CLINTON was using a private email server. noted 


that CLINTON was not an email person and therefore assumed that CLINTON was conducting personal 
business when she was on her Blackberry 


(U/FOHO)L____ also worked closely with JAKE SULLIVAN, CLINTON 's Chief of Staff 
for Political Affairs, for routine matters. understood that SULLIVAN would relay pertainent 
information to CLINTON but she did not know if SULLIVAN directly forwarded her emails to 
CLINTON or not.| provided that she occasionally interacted with CHERYL MILLS but did 
not have regular contact with HUMA ABEDIN. 


Investigation on — 12/11/2015 at Washington. D.C. 
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b7c 
Шөнө reviewed an email, that she sent on 
ith the subject piece.” She confirmed that she 


remembered the events surrounding the email. After carefully reviewing the entire email string BS 
gave a brief overview of the Benghazi attack and provided that this email was sent after she 

learned that the New York Times was planning to publish an article about the Benghazi attack and the 

annex. The topic was of particular interest because at that time the media only knew of the Consulate in 

Benghazi and information on the annex had not yet been publicly released 


Us further explained tha. 
was to notify Department of State leadership when the media was preparing to b6 


release information on sensitive or controversial topics. Alerting leadership allowed the Department of b7C 
State an opportunity to engage the media outlet to negotiate what details should be released and to prepare 

an appropriate public response. stated that she sent the email in question to alert Department 

of State leadership and National Security Council personnel of the upcoming article because of potential 

sensitivies around disclosing the existence of the annex. The subsequent messages in the email chain are 


responses from other individuals as they discussed a subsequent call that occurred with the New York 
Times that afternoon. 


(U//FGUO) During the discussion ^ Jprovided that she is participating in the Freedom of b6 
1A for the ongoing release of CLINTON's emails. С SIE 

has a team of individuals who are reviewing all 

emails pertinent to prior to their release, to assess if they contain 

information that is either classified or represents an internal Department of State deliberation 


(ш ӨНӨ] explained that internal deliberations are internal discussions about various 
international affairs and policies. These conversations do not necessarily reflect the official, or final, 
stance of the Department of State on a specific topic. Additionally, the information may be misconstrued 
by the casual reader or cause embarrassment to the Department of State if it is released in its original P 
form, When her team finds an email containing a deliberative discussion they mark the relevant sections Pc 
for redaction under the B5 exception. C ee the team's work before it is passed to the next 
phase of the review process within the Department of State. С ое that a significant number of 
the items that her group recommended for redaction because they were deliberative products were 
i arked for redaction, by internal counsel, using the classified material (B1) exception. 
mmm" not know why internal counsel elected not to follow her group's recommendations but 
noted that as a result a significant number of FOIA released documents that are marked as containing 
classified information really only contain deliberative material. 


(U//F8U9) [LL þcknowledged that some of the emails marked as containing classified b6 


information did in fact have classified material. However, she quickly noted that she did not recall seeing BIC 
anything that would potentially compromise national security or be considered criminal in nature 


HRC-186 


FD-302a (Rev. 10-06-95) 


Continuation of FD-302 of. Interview o: ] „ On 12/11/2015 . Page 3 


(U//FOUO) explained that the U.S. Department of State personnel commonly operate 
on the unclassified system е gave the example of a diplomat who summarizes a diplomatic 
conversation on the unclassified computer system. In general, they don't believe such diplomatic 
conversations are classified because it is usually obtained through diplomatic discussions and not from 
sensitive sources, They would consider the discussion to be Sensitive But Unclassified (SBU) and 
transmitted on OpenNet with the expectation that it would be contained on the Department of State 
system and only accessed by legitimate users. 


Based on these experiences she is careful not to transmit sensitive information on the 
unclassified or unsecured systems and she advised her subordinates to do the same. However, despite her 
security posture she did not find fault with her colleagues who did otherwise. 


(U//FGUO) A copy of the original interview notes are attached in a 1A envelope. 
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Бас of transcription _ 1/19/2016. 


7.2016, SIDNEY BLUMENTHAL was interviewed at the law offices of 
Washington, DC 20005 by Federal Bureau of Investigation (FBI) 


Special Agent (SA Also present for the interview 
was BLUMENTHAL's attorney. office telephon: mail address 
=! as well as Department of Justice attorneys| and 


After being advised of the identity of the interviewing agents and the nature of the 
interview, BLUMENTHAL provided the following: 


(U//FE9HO) BLUMENTHAL is a friend of HILLARY CLINTON (CLINTON). During her 
tenure as Secretary of State from 2009-2013, he served as an informal political advisor by sending emails 
containing information he deemed to be helpful and interesting topics. BLUMENTHAL did not recall 
sending any such emails prior to CLINTON becoming Secretary of State. There was no set schedule for 
these emails, BLUMENTHAL was never paid for his advisory services, and there was no specific 
conversation with CLINTON regarding his informal role. However, CLINTON would occasionally 
acknowledge the value of his emails in a response to BLUMENTHAL. During this time, 
BLUMENTHAL was also employed by the Clinton Foundation where his duties were related to former 
President BILL CLINTON, his 1 nd some communications of the Foundation. BLUMENTHAL 
reported to and does not recall what HILLARY 
CLINTON 's role was in defining his role at the Foundation. During this timeframe, BLUMENTHAL 
was also involved with the Clinton Global Initiative. 


(SIMS. TYLER DRUMHELLER was a career Central Intelligence Agency (CIA) employee who 

served in a number of capacities during his tenure 
During the timeframe in which 

BLUMENTHAL used DRUMHELLER as a source for information provided to CLINTON, 
DRUMHELLER was retired from the CIA. DRUMHELLER knew the information he provided would be 
forwarded to CLINTON and provided it because he thought the information would be useful and helpful 
to the United States Government (USG). He did not receive any compensation for the information. The 
caveats provided regarding the source of the information were directly from DRUMHELLER, with the 
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exception of the CONFIDENTIAL marking BLUMENTHAL would frequently place at the top of his 
communications with CLINTON. The CONFIDENTIAL marking was meant to imply the email was of a 
personal nature from BLUMENTHAL and did not refer to classified USG information 


(U/FO88O) DRUMHELLER had a business with large corporate contracts, but BLUMENTHAL 
did not know specifically who these contracts were with or what they were for. During a conversation 
with DRUMHELLER regarding humanitarian aid projects, BLUMENTHAL conceived of a project that 
would provide field hospitals and aid to Libyan refugees. DRUMHELLER stated BLUMENTHAL 
would receive a finder's fee if the project materialized, but it did not come to fruition. This potential 
finder's fee was the only financial relationship between DRUMHELLER and BLUMENTHAL, 


(UBH CL þa been a friend of BLUMENTHAL for several years and was — P6 
retired during the time when BLUMENTHAL used him as a source. BLUMENTHAL does not know BIG 
КУЛ шиш??? get the information he provided. 


b6 
(U//F889) [=== = = Ul a journalist involved in international education and has beena — ртс 
friend of BLUMENTHAL 's for decades. 


3 JS//4F- GARY BERNTSEN is a retired CIA officer who BLUMENTHAL met through LARRY 
JOHNSON, another former CIA officer. JOHNSON wanted BLUMENTHAL to hear BERNTSEN's 
story as described in BERNTSEN's book JAWBREAKER. Neither BERNTSEN nor JOHNSON ever 
stated they were providing classified information or that they obtained any information from the CIA. 
BLUMENTHAL did not ask if the information was classified. 


(UFONE: isafome[ who BLUMENTHAL 55 
met when| was assigned to] in the 1980s £ 


T WAB BILL MURRAY is a former CIA Chief of Station and a friend of DRUMHELLER. 


Wowo “аве [аши ье 
GORDON BROWN and TONY BLAIR administrations. He is an old friend of BLUMENTHAL'sand 7c 
provided information on British politics and personalities. 


(U//FO9O) 
BLUMENTHAL met through 
ASSAD, as well as others in the| 
information on the ASSAD regime 


(U//FOUO) is a —  ]wih experience i[ 1] b6 


provided information he picked up and sometimes knew the information ътс 
would be provided to CLINTON 


who bé 
BASHAR AL- b7C 
government personally. He provided BLUMENTHAL with 


Spex secos 
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(U//PFOU86) BLUMENTHAL had no concerns regarding the sensitivity of the information he 
provided to CLINTON during her term as Secretary of State. Additionally, he does not believe any of it 
was classified. 


(U/AF606) BLUMENTHAL held a clearance in the 1997-2001 timeframe when he was an 
assistant to President BILL CLINTON. He recalled a quick briefing on security and clearances, but has 
no recollection of being read-on to any special programs. 
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at the Central Intelligence Age ътс 
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rovided the following information: 


the purpose of the interview: 
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bl per CIA 
b3 


bl per CIA 
b3 


with the subject Г Tewing the email he provide 
hat he would have classified the email if he was sending fe inTomiatou. bl per CIA 
b3 


with the 
believed that the email was discussin 
time figuring out what the email was about. 


an email tron bl per CIA 
A fter reviewing the email. p3, 


ut stated that a casual reader would have a НСО 


bl per CIA 
b3 

the subjec 

reviewing the email stated that he would not have put this information on an unclassified system 

but that the authors were only responding tò a media article. 


(U/POBO) A copy of the original interview notes and the referenced documents is enclosed in a 
ТА envelope. 


b3 


HRC-192 


ALL FBI I 
HEREIN I8 
DATE 08-1 


MATION CONTAINED 
SSI 
3-2015 BY 


7385194 NSICG 


FD-302a (Rev. 10-6-95) 
ie 


FEDERAL BUREAU OF INVESTIGATION 


Daie of transcripiion _1/2/2016 


(U/PORO) On December31,2015| Jo 
interviewed by Federal Bureau of Investigation (FBI) Special A; 
Also present were Beth Wilkinson, Partner, and Attorney at Law, at Paul 
Weiss, Rifkind, Wharton & Garrison LLP, 2001 K Street, NW, Washington, D.C., 20006, and 
U.S. Department of Justice. After being advised of the identities of the 
interviewing agents, and the purpose of the interview[ ——— ]provided the following information 


u/£ouo[  J]has worked for HILLARY CLINTON sinc 


In this role he served a: 
worked on her campaign and was subsequently named 


when he was hired as her 


when CLINTON became the Secretary of Stat n t the Department of State (State). 
Currently works ai but noted that he still acts as a 


part time advisor to CLINTON. 


reported t and was primarily responsible for leading the| team 
and for acting as the Secretary' — n with the Secretary on all of her 
trips, with the exception of two or three trips noted that zero percent of his official job function 


was related to Information Technology (IT) or the maintenance of the Secretary' s phones or computers. 
However[ — — ]was technically savvy and was frequently in contact with the Secretary and as a result 
she often asked him for assistance with such matters EES likened it to your parents asking for 
technical help with their phone or computer. 


Cae e Оваа regular and ongoing contact with the 


Secretary and, as such, the majority of their communications occurred in person. However, he would 
communicate with her via phone or email when necessary. С] stated that he received his first email 
from CLINTON in 2007 and confirmed that she used the following email accounts 
h15(att.blackberry.net, hdr22Q)clintonemail.com[ ^ ]@втайсот during her tenure. 


(U/resey þtated that he had no knowledge of CLINTON's private email server until it 
recently became public knowledge INE. JUSTIN COOPER because Cooper was a long time 
aide for Bill Clinton. [—  ]never discussed the private server with COOPER until after it was 
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documented in the press. Similarly [knew BRYAN PAGLIANO but never discussed the email 
setup or any other IT matters with him. 


(U//F8UO) Upon starting at State in 2009[ ^ þeceived a security clearance and received 
training on the handling of classified information. He was provided with a classified terminal at his desk 
but didn't have a reason to communicate classified information via email given his position. He could not 
recall any specific instances of using the classified email system and stated that he never transmitted 
anything marked as classified on an unclassified system. 


(U/Fege[ pid not recall receiving any guidance from State on records management or 
the use of private email for official business. However, he noted that it may have been included in one of 
the numerous documents that he was required to sign when he first started at State. None; tried 
to use his official email for official business and his personal email for personal business. pen 
that there were some instances where he would email the Secretary from his personal email account such 
as when he was at home or traveling and wanted to send an article or press clipping of interest to the 
Secretary. Other examples of when he did this included when he first started and did not have a 
government email account; times when there were system outages, or when he had difficulty remotely 
accessing the system| provided that the Secretary neither approved of, or discouraged, the use of 
his private email account in these instances. [had no knowledge of any intrusions or attacks 
against either his personal or government email accounts. 


(ше өнө] шей the Secretary as `EVERGREEN' in his personal email contact list. He 
explained that this had been the codename used by the Secret Service since she was the first lady. 


(U//FOUO) During the interview хаз shown several emails that he had authored during 
his tenure at State while providing technical support to the Secretary [==] reviewed each email and 
provided the following context 


1. The first email was sent in approximately 2010 after he purchased the first iPad for the 
Secretary. id not recall the specifications for the device but believed it was the 
latest model available at that time [_____]purchased the iPad and configured it to use 
the| Дегай. сот email account so that he could send articles of interest to the 


Secretary stated that she could not view the articles on her Blackberry and the 
iPad and email account were setup as a way to test a different delivery method [Г] 
did not recall the email account being used thereafter and was “fairly sure it wasn't used” 
after the initial setup. 


2. The second email was sent just prior to the end of the Е s term buf____kcould 


not recall any further details about the context of the email | stated that he only 
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m 


purchased one iPad for the Secretary and could not remember a second iPad, or any details 
of a recovery email eae кош how after he gave the Secretary the iPad, 
the Secretary fell asleep holding the unopened packaging in her arms. This struck| 

as funny because, in contrast, he would not be able to sleep if he had just received a new 
iPad. He noted that this episode was foreshadowing for how little she would use the iPad. 


The third email referred to the cover of a People Magazine edition from August 2010 and 
was an example of when ^ would use his personal email to send a message to the 
Secretary. 


Я [С foua not recall any specific details regarding the fourth email but speculated that 


it referred to the collating of relevant news clips. 


In the fifth email the term “Dirty Space” refers to a non SCIF space, where unsecured 
communications could be used 


The sixth email references the Secretary’ s transition between Blackberry аме] 
remembered that her first device was blue in color but he could not recall ће make ог 
model С Дава that her second Blackberry was “not blue” but again could not 
recall any additional details. The second device was remotely activated by COOPER and 
then| rovided it to the Secretary once it was activated. He was unsure if she had 
additional Blackberry devices thereafter. 


The seventh email references a photograph that the Secretary took of the reporters 
traveling with her while they were in Greenland or Iceland. The Secretary wanted to share 
the photo with the individuals in the picture and asked, o remove any 
"identifiers" before sending the picture to them. stated that "identifiers" simply 
referred to the Secretary' s email address as she did not want to inadvertently give out her 
email address 


The eighth email refers to the Secretary' s house in Washington, D.C., on Whitehaven St 
While discussing the email provided that he did not recall any other emails being 
configured on the iPad besides| gmail.com. Nor did he see her use any other 
devices to access the clintonemail.com domain, aside from her Blackberry. He did not 
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recall her traveling with a laptop or other personal computers 
9. The ninth email references the switch to a personal office email system that was created 
after the Secretary left State. stated that he had no involvement in the process P. 
aside from what is described in the email and that he did not have any other interactions 
with Platte River Networks. He was unsure who secured the hrcoffice.com domain but did 
not believe that it wa[ [шше provided that after leaving State 
he acted as a paid advisor to the Secretary while she was promoting her book. During this 
time he used a personal Gmail account until the hrcoffice domain was stood up 
qeese[ | provided that he was not directly involved in culling the Secretary! s 60,000 emails PA 


aside from reviewing approximately half a dozen emails. In those instances, he was asked to provide the 
reviewers with additional context about the emails. 


(U//F8U9) A copy of the above referenced emails and the original interview notes are attached in 
a 1A envelope. 
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(U//F89O) On June 21, 2016 es 


was interviewed by 
Federal Bureau of Investigation (FBI) Special Agent: i 


in his 
Washington, DC, After being advised of the 
identities of the interviewing agents, and the purpose of the ineview| ^ provided the following 
information 


О/ЖӨЫӨ) From January, 2009, until January, 201 1 ]was hd  — E] PS 
lat the United States Department of State (DoS). In this capacity, e 


(U//FO€9O) Following his tenure at DoS[ — Моей at the| pe 
In June of 2012 576 
here he served as the 
in 2015 for his current position with the 

wrewel — hei a Top Secret (TS)/Sensitive Compartmented Information (SCI) b6 
clearance while at DoS. He interacted regularly with Secretary of State HILLARY R. CLINTON, and 216 
accompanied her on а few international trips pers not in direct email contact with CLINTON, 
and was not aware until recently how much of the information he emailed to her staff was forwarded up to 
CLINTON. L Jrecalled knowing CLINTON had a *different" account than others at DoS, but 
did not know it was a "private" email account. 

(U//FOHO) While at ро$[ fim " ” attended Deputies Committee (DC) and bé 
Principal Committee (PC) meetings. However, was present for more PC and DC meetings 516 
when he was Mule The NSC hosted all PC and DC meetings, which were 
convened by either the National Security Advisor or Deputy National Security Advisor. DoS was not 
present at every PC or DC meeting. Invitations and attendance depended on the topic. When DoS was 
invited to a PC or DC meeting, it was not uncommon for the DoS Regional Bureaus to send 
representation relevant to the topic of discussion. 

b3 
Investigation on __ 6/21/2016 at Washington, D.C. ЪТЕ 
ris [ —— þe Date dictated — N/A 
By S SA bé 
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qu/rese[ was familiar with the |Report,” and recalled  — — — Jwas be 


tasked with conducting a policy review of Afghanistan and Pakistan early in President OBAMA's bc 
administration C not recall how many different versions of the[ Керо were 
generated. 


(U//FGUO) Agents аке [фо review an email and attachment dated 10/4/2009 апа with Bs 
the Subject: “draft” and an attachment title “Pak Paper 10-03dc.docx." After reviewing the email and bie 
attachment[ —— explained he vaguely remembered the period of time surrounding the email, but 
did not specifically recall the email or attachment. [сера he would not have been one to 
write the document attached to the email, and believed it was likely drafted by somebody in the Special 
Representative to Afghanistan and Pakistan's (SRAP) Office. [eme 


would have likely been one of. 
the final reviewers of the document, describing himself as the *Clean up guy." Cd 


who was in the DoS Policy Planning Office, may have also been involved in drafting the document. 


(U//FOUG) Agents drewL______ attention to the fact that information contained in the be 
referenced 10/4/2009 email attachment also appeared as SECRET//NOFORN in a March, 2009, version эле 
of thel Report. did not know who at DoS would have ultimately determined the 
classification of the document assessed either CLINTON or someone in her front office 
would have classified the document. believed CLINTON and RICHARD HOLBROOKE 
would have at least read the contents of the report prior to finalization. Specific information contained in 
the report was publically discussed at the time, so in opinion, the document was not 
classified. Much of the information contained in the report was originally based from various 
contributors' expertise; therefore it would not have been classified. He further stated that while he had no 
visibility into the DoS classification approval р the report might have been 
considered Unclassified while it was a working document, and later classified when it became an official 
record. It also could have been marked classified because almost all documents intended for the NSC are 
classified for transmission 


S/PSE bl 
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(U//F8'8O) Notes of the interview and the documents displayed ө] will be maintained 


in an FD340 envelope and filed with the captioned investigation. 
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(U//F9UO) On 11/23/2015 
was interviewed in his office at th 
Investigation (FBI) Special Agents (SA 
the identity of the interviewing agents, and the nature of the interview] 
following information 


U//FOUO) From 2010 through 2012[— емей as the 
in the Department of State (DoS) Bureau of Near Eastern Affairs (NEA). 
oversaw the office which focused on DoS interests in North Africa ER S the DoS senior level 
expert оп 


After being advised of 
provided the 


(UFOO did not directly communicate with Secretary of State HILLARY R 
CLINTON, in fact, did not recall ever communicating directly with any Secretary of State. 
Саа not recall ever communicating directly with CLINTON's executive staff. a 


may have exchanged an email with CLINTON's Chief of Staff for Public Affairs, JACOB SULLIVAN, 
on one or two occasions. Chia not recall ever communicating directly with CLINTON 's Chief 
of Staff for Operations, CHERYL MILLS 


(U//ROUO interfaced with DoS executive management predominately through his 
superiors in NEA would communicate to Deputy Assistant Secretary (DAS) JANET 
SANDERSON and RAY MAXWELL or Assistant Secretary JEFFREY D. FELTMAN, who was later 
replaced by BETH JONES 


(u/rege[ ^ and NEA management had separate computer terminals for handling 
Unclassified and Classified materials. 


(U//FOUO) During his tenure as w[ ш 
on the phone daily with the then Ambassador of Libya, CHRISTOPHER J. STEVENS, who was later 
killed in the September 12, 2012 attacks on the U.S. consulate in Benghazi, Libya[ -— оша 
come into work early and talk to STEVENS on the phone. [d STEVENS would 
communicate through both open and classified means of communication. However, the classified 
communication capabilities were limited in Libya 


Investigationon.— 11/23/2015 at Washington, D.C. 
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(U//F99O) Following his conversations with STEVENS ould orally brief the NEA 
DAS. Ifthe information was particularly time sensitive, ould sometimes write an email. 
assumed the NEA DAS briefed up whatever information they deemed important from 
riefings to SULLIVAN and/or MILLS. Questions nri the information| 


provided came back down through his chain of command. did not recall ever being directly 
questioned by CLINTON, MILLS or SULLIVAN regarding any of his reporting. 


was not aware CLINTON was using a private email account not assigned 
have knowledge that CLINTON' s email was hosted on a private, non-DoS, 
did not recall ever receiving a direct email from CLINTON, other than an email or 
two that would have been sent to the entire DoS.[ — only learned of CLINTON's private email 
and server when the story broke in the Press earlier this year. 


(U//FOUO) Agents asked — ]toreviewanemai[ Вагей 11/18/2012 with the 


Subject line *FYI — Reports of arrests — possible Benghazi connection." The email was shown to 
as it was released by DoS FOIA office, and as it appeared on the DoS Reading Room. 
— that the email 
was sent on a Sunday evening, and it would not have been unusual for| to be in his office 
during that time. [һә that he likely sent the email from the office, but sent it via 
unclassified email, as most of the people who needed to be briefed on the information were not in the 
office and did not have access to classified communications at the time. 


(U//FOUO) The individual] Jadaressed the email in question to were as follows: 


BETH E. JONES, Assistant Secretary NEA 
RAYMOND D. MAXWELL, Deputy Assistant Secretary NEA 


spoke nearly 
daily during The two would converse 
via high side email or orally. assessed that the information he typed in the email concerning 


|was received via an unclassified telephone conversation. He further assessed 
received the information from the RSO or Legal Attaché (LEGAT) visiting from Cairo 
(U/FesgeJ — nad no knowledge of his email being forwarded, but assumed that the 
individuals he emailed direct would either forward the information on to the appropriate executives or 
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brief them orally LLL noted that in general if information is sent to SULLIVAN, he assumed it b6 
would be forwarded or briefed to CLINTON. PIG: 
(шж өнө] ^  Jnoted that some of the language contained in the email may have later b6 
been classified, but due to special circumstances surrounding the situation at the time he received the PIS 
information, there was a necessity to share the information quickly. 
(U//FG99) kept notes with his calendar, and may have recorded some information m 
concerning the call that preceded the email in question | 7 he would attempt to locate 


his calendar/notes from that time period if requested 


(U//KGUQ)) interacted with the DoS Ops Center а few times a week during the Libya s 
crisis. The Ops Center would set up management level conference calls. DoS's Crisis Management e 
Group was also collocated in the Ops Center during the crisis in Libya 


(U//FOUO9 prefers oral briefings over email, and noted he did not grow up in the age be, 
of email. оез not mark his DoS emails for the record, but maintains an archive of his PIS 


personal DoS email account when his mailbox fills up and he needs to free-up more space 


(цжөнө] [ее used a non-DoS email account for work related communications. Lo 


(U/FOHO[| —  ] was never asked to move something from the high side to the low side in b6 
a way that seemed inappropriate. PC 


(U//FGO) Agents notes are maintained in a ТА envelope. 
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(О/ ӘНӘ) On May 24, 2016, HEATHER SAMUELSON, Date of Birth (DOB | 

was interviewed by Federal Bureau of Investigation (FBI) Special Agent: and 
[t the law offices of Wilkinson Walsh + Eskovitz, 1900 M Street NW, Suite 800, 

Washington, DC. Present for the interview was SAMUELSON 's counsel, Beth Wilkinson, Partner, 
Alexandra Walsh, Partner, and Hal Brewster, Associate. Also present was FBI Section Chief Peter Strzok, 
as well аа] from the Department of Justice (DoJ) Counterintelligence 
and Export Control Section. After being advised of the identities of the interviewing agents and the 
purpose of the interview SAMUELSON provided the following information: 


(U//F989) SAMUELSON is currently serving as a personal attorney for HILLARY CLINTON 
She previously worked at the Department of State (DOS) during CLINTON 's tenure as the Secretary of 
State. SAMUELSON initially worked as an assistant in the White House Liaison Office at DOS and then 
was promoted to the head of the office. SAMUELSON had infrequent interaction with CLINTON while 
she was at DOS and primarily interacted with CHERYL MILLS. Following the completion of 
CLINTON's tenure, SAMUELSON worked for one year in the office of the White House Counsel before 
becoming CLINTON 's personal attorney. 


(U//FOUO) SAMUELSON held a TS/SCI security clearance while she was at DOS. She 
maintained the clearance when she left DOS and still holds the clearance today. SAMUELSON's 
clearance was reinvestigated in 2014 per standard procedures. SAMUELSON received training on the 
handling of classified information when she received her clearance and after the reinvestigation but she 
did not recall the specifics of the training. SAMUELSON did not receive training on the Freedom of 
Information Act (FOIA) or the Federal Records Act while at DOS. However, she did receive training on 
the Presidential Records Act while she was at the White House. SAMUELSON did not receive any 
specific guidance on what documents she should retain when she left DOS 


(U//FOUO) SAMUELSON provided that she only received two emails from CLINTON while she 
was at DOS; one on her birthday and another following the death of SAMUELSON' s grandmother. 
SAMUELSON did not become aware of CLINTON's use of a private email account and server until she 
was serving as CLINTON's personal attorney. 


Investigation on. — 5/24/2016. а Washington, DC 
кє# [  — pe Daicdictacd — N/A. 
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(U//F893HO) SAMUELSON had no contemporaneous knowledge of the decision to transition from 
the private server in Chappaqua, NY to the services of Platte River Networks (PRN). Nor did 
SAMUELSON have contemporaneous knowledge that an archive of CLINTON's emails was created by 
MONICA HANLEY following CLINTON's tenure at DOS. SAMUELSON did not know the location of 
the laptop, or thumb drive, containing the archive created by HANLEY 


(U//FBG8O) SAMUELSON knew CLINTON transitioned her email to an @hreoffice.com domain 
following her tenure at DOS. SAMUELSON believed no old emails were transferred from the 
@clintonemail.com to the new domain. SAMUELSON did not know how CLINTON or HUMA 
ABEDIN accessed old emails after the new domain was established. 


Request from DOS 


(U//FOUO) SAMUELSON provided that she was not involved in the initial discussions with DOS 
regarding the production of records from CLINTON's tenure. SAMUELSON believed DOS had noticed 
gaps in its records and had reached out to CLINTON, and other former Secretaries of State, to request that 
they produce any relevant records in their possession. MILLS spoke with the department about this 
request in late July or early August 2014 and then asked SAMUELSON to assist with the effort. MILLS 
also received a formal letter from DOS Under Secretary PATRICK KENNEDY, in October 2014 
regarding the request 


(U//F9UO) To SAMUELSON's knowledge DOS did not provide any formal guidance on how to 
conduct the search aside from indicating that it was CLINTON's responsibility to assess which products 
were work related and which were personal. SAMUELSON stated that DAVID KENDALL and others 
from Williams & Connolly LLP served as external representation for CLINTON in this matter. 


Collection of Relevant Emails 


(U//FOU3O) SAMUELSON had no emails that were responsive to the DOS request before she 
contacted PRN, In late July or early August of 2014 she requested PRN provide all emails from 


CLINTON 's tenure that were sent to, or received from, a “.gov” email address| of 
PRN, extracted the relevant files and then transferred them to SAMUELSON. To transfer the files, 

sent SAMUELSON an email link that gave him access to her computer after she clicked on 
it. then downloaded the email files onto her laptop and configured them so she could access 


the password protected emails via Microsoft Outlook. SAMUELSON described herself as "technically 
deficient" and stated she was near her computer while this transfer occurred but she did not pay close 
attention to what he was doing. She did not recall the name of the file he transferred to her computer, the 
location on her computer where it was placed, or { фоок any steps to encrypt the file before 
transferring it 


(U/FOYS SAMUELSON was not aware ofh — hueried the files or what 


mailboxes on the PRN server were searched. More specifically, she did not know if the emails were taken 
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from the live mailbox or from the HRC archive that had previously been provided to PRN by HANLEY. 
SAMUELSON stated that she just asked PRN for the “ gov" emails A 87 gave them to her. 


(U//F8UO» In late September or early October of 2014, SAMUELSON requested that PRN 
provide a full export of all of the emails from CLINTON 's tenure to ensure they captured all relevant 
emails. SAMUELSON stated this request was not done in response to any identified gaps, but in an effort 
to produce all relevant emails [EE OO the full export to SAMUELSON using the same 
remote access process as described above. While providing the full email export to SAMUELSON, he 
removed the previously provided “.gov” emails. Upon realizing this SAMUELSON аѕке 
to give her the “роу” export files again because she wanted to use it as the starting point for her 
collection of responsive records. Upon receiving the “.gov” export for a second time, SAMUELSON 
noticed that some of the emails from the initial export were no longer included. SAMUELSON recalled 
that there seemed to be a pattern with the missing emails and it involved “.gov” addresses that were in the 
carbon copy (CC) line of the email. SAMUELSON again contacted PRN and requested that they provide 
the missing documents and in eiue 2 007 70 several smaller .pst exports to fill the 
identified gaps. 


(Ц/Я ӨНӨ) SAMUELSON had requested PRN pull all emails from Clinton's tenure, January 
2009 to February 2013. However, upon receiving the above described exports she noticed emails were 
missing for the period of January 2009 to March 2009. She asked PRN to double check for emails from 
that time period but they were unable to locate any responsive emails. SAMUELSON came to believe that 
those emails were not backed up on any server and had only resided on the Blackberry CLINTON was 
using at that time, thus making them un-retrievable. SAMUELSON did not have contemporaneous 
knowledge of the Apple server and therefore did not make an effort to check it for relevant records. In 
searching for other relevant records, SAMUELSON checked the етай com account and 
found one email exchange. SAMUELSON did not contact other associates of CLINTON, to include 
HANLEY, to request any records they might have. 


(U//FGHO) SAMUELSON was shown а PRN invoice #37068, dated August 16, 2014, which 
contains the work description “Worked with Heather via phone/remote session to restore access to 
archived emails per CDM.” In response, SAMUELSON stated that she did not know what that work 
description meant and that she didn't recall ever losing access to the exported emails, aside from when the 
initial “ роу” export was removed буј 


(U//FBUO) SAMUELSON was shown an internal PRN email fromL_______lreferencing an 
urgent phone call with CESC on November 24, 2104, to which she provided she had no recollection of 
what the call was about. SAMUELSON was then shown a PRN work ticket report from November 24, 
2014, which contains the summary note “Worked with Heather via phone/remote control session on more 
specific export requirements.” In response, SAMUELSON stated she could not speculate on what those 
notes meant and she was unaware of any activities by PRN to “re-establish connection to HRC emails” in 
November of 2014 
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(U//FG89) SAMUELSON was never given direct access to the mailboxes on the server and she 
was not aware of anybody else being granted such access. SAMUELSON was never given administrative 
access to the server and she was not aware of anybody else being granted administrative access. 


Cull and Review of Emails 


(U//Fe¥e) SAMUELSON stated she was primarily responsible for conducting the review at the 
direction of MILLS and KENDALL. She conducted the review over the course of several months and 
completed it just prior to December 5, 2014, when the documents were turned over to DOS. 
SAMUELSON conducted the review on her laptop, both in her apartment and in MILLS' office in 
Friendship Heights, Washington DC 


(U//FGHO) SAMUELSON reviewed the emails provided by PRN in Microsoft Outlook and 
placed any responsive emails in a separate folder. She began by adding all of the “.gov” emails and any 
email to or бота“. тії” email address to the folder. She then searched the emails provided by PRN for 
any email to or from senior leadership at DOS. This included key individuals such as Under Secretaries, 
Assistant Secretaries, Ambassadors, Department Heads, and Senior DOS Aides. SAMUELSON then 
reviewed the sender and receivers of the remaining emails to identify any congress members, foreign 
leaders, or other official contacts. Lastly, she searched the remaining emails for key words that included 
terms such as Afghanistan, Libya, and Benghazi. 


(О/ЖӨЪӨ) SAMUELSON reviewed the sender, receiver and subject line of every single email 
during the review. However, she stated that she did not read the content of each individual email if she 
could determine it was a work or personal email from the sender, receiver or subject line. SAMUELSON 
provided that she did her best to review and identify any emails that were potentially a mix of work and 
personal content. When asked how work related emails between ABEDIN and CLINTON may have been 
missed, SAMUELSON stated ABEDIN may have kept emails that CLINTON did not 


(U//F88O) SAMUELSON did not have a formal process for removing duplicate copies of the 
same email from the set of work related emails. She did not ask PRN to assist with this process 
SAMUELSON stated she would remove a copy of the email if she noticed that it was a duplicate but she 
did not have a formalized or consistent process for identifying and removing duplicates. 


(Ш/ ӨНӘ) Upon completing the review, SAMUELSON printed all of the emails she deemed to 
be relevant. The paper copies were then subsequently reviewed by MILLS and KENDALL and anything 
they deemed not to be work related was shredded. The remaining physical documents were ultimately 
provided to DOS. SAMUELSON stated that she printed the emails in MILLS' office and noted there is 
still a printer in MILLS' office but she was not sure if it was the same printer 


(U//FOUO) Following the review, SAMUELSON created a digital copy, or a “preservation copy,” 
of the relevant documents that were provided to DOS. The files were placed on a thumb drive and 
provided to KENDALL. SAMUELSON believed this drive is the same thumb drive provided to the FBI 
by KENDALL. SAMUELSON also created a second copy of the documents provided to DOS and placed 
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them on a second laptop of hers. SAMUELSON was not aware of any other copies of the files. Nor was 
she aware of a master copy of all of the personal and private emails. 


(U//FOG8O) SAMUELSON was shown copies of the thumb drives previously provided to the FBI 
but could not recall if any were the same as the one she had used. One of the thumb drives was labeled as 
*HC PRIME 2" and SAMUELSON did not know what the label referred to 


(U//F8UO) The review methodology was developed by SAMUELSON, MILLS and KENDALL. 
SAMUELSON did not consider using any commercially available e-discovery tools for the review and 
they did not consult any individuals who were not *an agent of Clinton" during the review process. 
SAMUELSON stated they did not discuss how to handle potentially classified emails during the review 
because they had no reason to believe any classified material was contained in the emails. She further 
noted that none of the emails were marked as being classified. 


(U//F8U9) During the review process SAMUELSON noticed the imported emails displayed 
CLINTON's email as hrod17@clintonemail.com despite the fact this address was not created until after 
CLINTON's tenure. SAMUELSON discussed the issue wih[ — Дыш she did not fully 
understand his explanation for why this was occurring and he was never able to resolve the problem. 
SAMUELSON did not consult anybody else about this issue 


Deletion of Emails 


(U/FOUO) In January of 2015, SAMUELSON asked| ——— Jio remove the exported 
emails files that had previously been provided to her by PRN. While she retained separate digital copies 
of the emails provided to DOS, as discussed above, she no longer wanted the email exports provided by 
PRN on her computer. Using a similar process as described above, ccessed her computer 
remotely and removed the files. SAMUELSON provided tha took additional steps during 
the deletion process so the files would not be recoverable. SAMUELSON did not know what software or 
processes were used b[ —— þu believed that the files would be difficult, if not impossible, to 
recover. SAMUELSON did not remember having any discussions with| — Jabout deleting 
relevant data from the free space of her laptop. Nor did she recall any discussions a= 
about the use of “BleachBit.” SAMUELSON did not recall deleting any of the files by herself before 
contacting PRN. 


(О/ЖӘЫӘ) SAMUELSON stated that in May of 2015 she deleted some emails from her copy of 
the work related emails that were previously provided to DOS. SAMUELSON explained that she was 
notified by DOS, prior to the release of the first tranche of FOIA emails, that some of the work related 
emails they had turned over were classified. She was instructed by DOS to delete the files and then empty 
those files from the trash bin. SAMUELSON did not believe these files were removed from the thumb 
drive she had previously provided to KENDALL. 


(U//EOHO) In or about December of 2014, SAMUELSON was on a call in which the email 
retention policy was discussed. She was aware the retention period was changed to 60 days and any older 
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emails would be deleted. However, SAMUELSON did not direct PRN to remove any exported .pst files 
on the server or any mailboxes on the server. 


(U//FBUO) SAMUELSON was not aware of any other deletions of relevant emails. She was 
aware PRN traveled to the datacenter in March of 2015, via her role as counsel, but had not instructed 
them to do so. SAMUELSON was not aware of exports or deletions conducted by PRN on the server in 
September of 2015. 


Devices used During the Review 


(О/ ӨБӨ) SAMUELSON used her own laptop to conduct the review and noted that she also 
used the laptop for other work related matters as well. She described it as a Lenovo Yoga 2 laptop. 
SAMUELSON stated that following the review she accidentally spilled water on the laptop. Fearing that 
the computer would fail, she purchased a second Lenovo laptop and placed a copy of the emails that were 
prepared for DOS on it. SAMUELSON noted that the Lenovo Yoga 2 computer continued to work until 
sometime last year when it failed to power on. The Lenovo Yoga 2 computer is currently in the 
possession of her counsel and the second Lenovo was given to KENDALL and then subsequently turned 
over to the FBI. SAMUELSON reviewed pictures of the laptops that were previously turned over to the 
FBI and stated that the silver Lenovo laptop appeared to be the same as the laptop that she used. 


(U//FO9O) SAMUELSON stated that both laptops were connected to the internet and they both 
had antivirus software installed on them. SAMUELSON did not repurpose the laptops after the review 
and never attempted to reformat or factory reset the computers. 


(U//FO99O) A copy of the original interview notes are enclosed in a ТА envelope 
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MARCEL LEHEL LAZAR (LAZAR), also known as (AKA) "GUCCIFER", date of 
birth alien registration number was 
interviewed at the UNITED STATES ATTORNEY'S OFFICE (USAO), 401 Courthouse 
Square, Alexandria, Virginia 22314. LAZAR was advised that the nature of 
this interview was to discuss the extent of LAZAR's hacking activities 
related to HILLARY CLINTON's (CLINTON) personal email server. After being 
advised of the identities of the interviewing Agents and the nature of the 
interview, LAZAR provided the following information: 


LAZAR began by stating that he had never claimed to hack the CLINTON 
server. SA аа advised that FOX NEWS had recently published an 
article which reported that LAZAR had claimed to hack the CLINTON server. 
LAZAR then stated that he recalled the interview with FOX NEWS, and that he 
had lied to them about hacking the CLINTON server. SA[ ^ ]then asked 
LAZAR to provide a complete explanation of his hacking activities 
surrounding the CLINTON server. LAZAR provided the following information in 
response: 


On or about March 14, 2013, at approximately 6:00 AM [Romanian Time], 
LAZAR was perusing sd’ address book, Within it, LAZAR identified 
an AMERICA ONLINE (AOL) email account o£[ paoi.com, which he later 
detexmined to be the personal email account of SIDNEY BLUMENTHAL. LAZAR 
then made several attempts to access BLUMENTAL's email account. After 
approximately 20 minutes, LAZAR was able to successfully gain access to the 
account by correctly answering an account security question, which in tuxn 
allowed him to reset the password for the account. LAZAR then utilized the 
new user credentials to access BLUMENTHAL's account. 


LAZAR recalled that BLUMENTHAL's account contained approximately 
30,000 emails, which took him approximately six to seven hours to sort and 
review. LAZAR downloaded approximately 25 attachments that were contained 
in the emails, including memorandums (memos) and briefing documents. He 
recalled that some of those attachments were official memos between 
BLUMENTHAL and CLINTON. Additionally, LAZAR took screenshots of other items 
in the account that he deemed to be of interest. LAZAR recalled taking a 
screenshot of an email that contained information related to the Benghazi 
incident. 
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While looking through BLUMENTAL’s account, LAZAR identified one email 
exchange between BLUMENTHAL and CLINTON, where CLINTON was using the domain 
of clintonemail.com. LAZAR reviewed the header information for that email 
in attempt to identify the originating IP address for the mail server 
associated with that domain. LAZAR identified one corresponding IP addxess, 
which was 127.0.0.1. LAZAR recognized that IP address as being an internal 
routing address and assumed that it was assigned to an internal mail server 
at the AOL service provider. Therefore, LAZAR had no additional information 
about the CLINTON email server, and concluded his hacking attempts against 
it at that time. LAZAR stated that this was the full extent of his hacking 
activities related to the CLINTON email server. 


After spending approximately six or seven hours in BLUMENTHAL's 
account, LAZAR took a break from the computer which lasted approximately 
two to three hours. When he returned to the computer, he no longer had 
access to BLUMENTHAL's account. LAZAR recalled that his access was 
terminated around 8:00 AM[ ^ ]rime. He assumed that BLUMENTHAL likely b6 
made a phone call to AOL in order to reset his password and regain access bic 
to the account. LAZAR believed that BLUMENTHAL resided i[ at that 
time. 


As a form of normal practice, LAZAR would send the results of his 
hacking activities to news agencies world-wide. After accessing 
BLUMENTHAL’ s account, LAZAR contacted Eeee THE SMOKING GUN and b6 
advised that he was going to send the BLUMENTHAL information to b7C 
approximately 100 different news agencies, which he had identified prior to 
the compromise of BLUMENTHAL's account. 


LAZAR recalled using a variety of computer hacking tools for his 
hacking activities, such as ANGRYIP, METASPLOIT, SUBSEVEN, and CAIN AND 
ABLE. LAZAR used a remote administration tool (RAT) as well, to create his 
own malware. That tool operated by splitting an existing malware exploit 
into two pieces, manipulating the hexadecimal code, and then repacking the 
malware for deployment. LAZAR recalled using the SUBLEGEND? tool for this 
activity. LAZAR utilized this technique to send out spear-phishing emails 
to various targeted victims. The malware would ultimately install а 
key-logging software on the victim computer. 


When asked to elaborate on the key-logging software, LAZAR stated 
that he could not. When asked how he retrieved the results of the 
key-logging software from the victims, LAZAR provided that the software 
allowed him to enter a return email address and the results of the 
key-logger were emailed to that account. LAZAR could not recall the email 
accounts that he used for this activity. LAZAR sent this form of malware to 
approximately 100 different people and estimated that only approximately 15 
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of them ultimately opened the attachment. LAZAR did not send апу 
spear-phishing emails to users at the clintonemail.com domain. 


During other hacking quests, LAZAR utilized various IP scanning tools 
to determine whether or not an IP address was online and which ports they 
made available on the Internet. LAZAR recalled using the ANGRYIP scanning 
tool most frequently. LAZAR attempted to use Russian proxy servers for his 
Scanning activities in order to evade monitoring by the United States 
government. Russian IP proxies afforded him with faster Internet speeds 
than others. LAZAR repeatedly checked his outfacing IP address in order to 
ensure that he was using Russian proxies. 


When asked how he utilized Russian proxies with the ANGRYIP tool, 
LAZAR relayed that the tool itself afforded the ability to connect to 
Russian proxies. LAZAR could not provide any additional details on how the 
ANGRYIP tool accomplished this. 


When asked about other Internet proxy usage, LAZAR provided that he 
also utilized MOZILLA FIREFOX as his browser of choice, and that a plug-in 
was available for the browser which routed Internet traffic through Russian 
proxies. LAZAR could not provide any additional details on how the plug-in 
accomplished this, nor could he recall the plug-in that he used in FIREFOX. 
LAZAR also used the HIDEMYASS website for masking his online activities as 
well. 


In the beginning of the interview, LAZAR recalled using the METASPLOIT 
tool in approximately 2008 or 2009. He stated that he was merely an amateur 
with METASPLOIT and that he really didn’t understand how to use it. LAZAR 
utilized METASPLOIT on WINDOWS computers only, from a graphical user 
interface (GUI) rather than the WINDOWS command prompt. LAZAR is not 
familiar with the LINUX operating system. Later in the interview, LAZAR 
xecalled using METASPOIT in either 2009 or 2010, during which time frame he 
made a how-to FACEBOOK video that demonstrated how one could take a remote 
screenshot of a user’s desktop with METASPLOIT. 


LAZAR utilized the CAIN AND ABLE software tool for password cracking. 
He also used that tool from a GUI rather than the command prompt. LAZAR 
recalled that the GUI had green and red buttons on it. When asked to 
describe how he utilized the CAIN AND ABLE program, LAZAR stated that he 
would use it for password cracking once inside a network. When asked 
whether ox not he used it for cracking password hashes that were dumped 
from a system he replied yes. When asked to further describe the process of 
dumping password hashes from a system, LAZAR provided that he could not do 


UNCLASSIFIED//FOU6 
НАС-211 


FD-3022 (Rev. 05-08-10) 


UNCLASSIFIED//mBeUe 


Continuation of 0-202 of (U//POBE} Interview of Marcel Lehel LAZAR on 05/26/2016 page 4 of 4 BIE 


so in English. When asked whether or not he could gescribe that process in 
Romanian, he stated that he could not. LAZAR used the CAIN AND ABLE 
software product in either 2010 or 201i. 


LAZAR used other remote administration tools for his hacking 
activities, but could not recall the names of any of them. When targeting 
an IP address for access LAZAR often attempted to log into it via his web 
browser, by typing the IP address into the browser. LAZAR utilized multiple 
different computers for his hacking activities, none of which he has access 
to anymore. LAZAR recalled working vith computers since he was 
approximately 15 years old. 


On approximately four or five occasions during this interview, LAZAR 
referred to himself as being an amateur hacker and not a professional. On 
one occasion, LAZAR also referred to himself as being а "script kiddie”, 
who merely knows how to hack accounts by answering security account 
questions correctly, as he did with the BLUMENTHAL account. 


Present during this interview vere the following individuals: LAZAR, FBI. 


and LAZAR's Attorney, Public Defender 
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(U//FG89) On December 22, 2015, BRYAN PAGLIANO was interviewed by Federal Bureau of 


Investigation (FBI) Special a а Information b6 
Technology Specialist/Forensic Examiner at the offices of the Department of Justice' s 276 
Counterintelligence and Export Control Section (CES). Also present, were AkinGump atomeys| —.] 

y in. Counsel and Mark MacDougall, 
Partner. Additionally. and ^ [from the 


U.S. Department of Justice were also present. After being advised of the identities of the interviewing 


agents, and the purpose of the interview, PAGLIANO provided the following information 


b6 
b7C 


CLINTON, PAGLIANO came to work on HILLARY CLINTON's 2008 presidential campaign as an 
information technology specialist. Following HILLARY CLINTON's appointment as the Secretary of 
State in 2009, PAGLIANO gained employment at the Department of State (DOS) as an Information 
Technology Specialist in the Bureau of Resource Management 


(U//FGUO) In the fall of 2008, JUSTIN COOPER introduced himself to PAGLIANO via email 
and subsequently called PAGLIANO. In the call, COOPER stated he understood PAGLIANO was 
liquidating computer equipment from HILLARY CLINTON's 2008 presidential campaign and explained 
he was interested in transitioning from an Apple OS X private email server used by aides of BILL 
CLINTON to another email exchange server. COOPER asked PAGLIANO for help setting up new 
equipment to support a new email server and for assistance in the administration of the server. 
PAGLIANO began work on building an email server at K street using computer equipment from 
HILLARY CLINTON's 2008 presidential campaign. In late 2008, at the time PAGLIANO was building 
the server, he did not know HILLARY CLINTON would be Secretary of State or have an account on the 
server. PAGLIANO believed the email server he was building would be used for private email exchange 
with BILL CLINTON aides. 


(U//F8'89) Around March 2009, once the new server equipment was assembled, COOPER and 
PAGLIANO met at the CLINTON residence in Chappaqua, NY to install the server and migrate the email 
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accounts from the Apple OS X server to the new server. PAGLIANO also recalled а] b6 
as present, as well as some United States Secret Service (USSS) Special Agents. PAGLIANO RIS 

recalled the Apple OS X server to be in the basement at Chappaqua and consisting of an Apple Power 

Macintosh G4 or G5 tower and an HP printer supported by Internet Printing Protocol (IPP) over port 9100 

so that staff could print from the Harlem office. PAGLIANO installed the new server equipment which 

was comprised of a 12-unit (12U) rack with a Dell PowerEdge 1950 used as a Blackberry Enterprise 

Server (BES), Dell PowerEdge 2900, Dell unmanaged switch, 3U power supply, 3 terabyte (TB) external 

hard drive, Kiwi Syslog Server, and a Cisco Private Internet eXchange (PIX) 515E IP firewall (the 

collection of server equipment hereafter referred to as Exchange Server 1). PAGLIANO stated that he did 

not utilize tape backups but implemented “disk-to-disk” backups instead. PAGLIANO began the email 

migration from the Apple OS X server to Exchange Server 1 while on-site in Chappaqua in March 2009, 

but did not finish on-site and continued working on the migration from his hotel room. PAGLIANO 

believed he “popped out” all the email from the Apple OS X server when migrating and that no email 

content should have existed on the Apple OS X server once it was migrated to Exchange Server 1 

COOPER changed the Mail Exchange (MX) records to ensure delivery to Exchange Server 1. There were 

only two system administrators on Exchange Server 1, PAGLIANO and COOPER. PAGLIANO 

disagreed with housing Exchange Server | in a residential basement due to having only one unreliable 

internet connection. COOPER disagreed and wanted physical access to Exchange Server 1, PAGLIANO 

never knew of Exchange Server 1 residing in another physical location other than Chappaqua. 


(Ц/ ӨНӨ) As far as the Apple OS X server is concerned, PAGLIANO did not know of any other 
function or use of the server, other than to facilitate email exchange. PAGLIANO did not know who 
installed the Apple OS X server, but believed COOPER was the only person with administrator access. 
Two email domains existed on the Apple OS X server, presidentclinton.com and clintonemail.com. Both 
domains were also maintained on Exchange server 1. PAGLIANO believed] — 1] COOPER, b6 
n had email nts on the presidentclinton.com domain, and HUMA PIC 
ABEDIN and had email accounts on 
the clintonemail.com domain. Once email was migrated to Exchange server 1, all users could use either 
the presidentclinton.com or clintonemail.com domains for receiving email but replies would be sent from 
the clintonemail.com domain for users of the clintonemail.com domain. PAGLIANO did not know if 
HILLARY CLINTON had an account on the Apple OS X server, but he did not migrate one. PAGLIANO 
did not know how users connected to the Apple OS X server br COOPER would monitor the 
printer linked to the Apple OS X server, but PAGLIANO was unaware what, if anything, it was used for. 
PAGLIANO believed the people with physical access to the Apple OS X server was anyone who had 
access to the basement at the CLINTON residence[ —— Jhad physical access, but not administrative 
access, to the OS X server. Sometime after the email migration from the Apple OS X server to Exchange 
server | was complete, COOPER discussed repurposing the Apple OS X server with PAGLIANO. 
PAGLIANO believed the intention was for the Apple OS X server to be installed as a workstation 
somewhere in the basement in Chappaqua for use by either COOPER or| 
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(U//FOUO) PAGLIANO requisitioned the hardware for Exchange Server 1 from a datacenter at 
HILLARY CLINTON's presidential campaign headquarters at 4420 W. Fairfax Drive, Arlington, 
Virginia. He recalled the PowerEdge 2900 to have been a Microsoft SQL server and PAGLIANO did not 
recall if he wiped the drives of the hardware used to build Exchange Server 1. PAGLIANO made the 
decision to use a Microsoft Small Business Server (SBS) environment on Exchange Server 1 since he had 
used it before and assessed it would be perfect for a small amount of users exchanging email, Exchange 
Server 1 was only used for email exchange, and although PAGLIANO did enable Windows SharePoint 
Services, it was never used. PAGLIANO wanted to use a cloud service similar to that used in HILLARY 
CLINTON's 2008 Presidential campaign, but COOPER disagreed with PAGLIANO and did not want to 
use a cloud service. Because of this decision, PAGLIANO used an external hard drive to back-up 
Exchange Server 1 using Windows back-up service. To effect this change, PAGLIANO scheduled a task 
through Windows for a full back-up once a week and a differential back-up every day. These periodic 
back-ups would overwrite on the hard drive in a first-in, first-out manner. For security, PAGLIANO used 
Microsoft Forefront on the Dell PowerEdge 2900 as a baseline security analyzer. PAGLIANO recalled 
finding a virus, but recalled no other detail, other than it being nothing of great concem. PAGLIANO 
chose to turn File Transfer Protocol (FTP) off. 


(U//FOt3O) PAGLIANO thought the biggest vulnerability to Exchange Server 1 to be a Brute 
Force Attack (BFA). PAGLIANO stated that BFAs increased over the life of the server and he set-up the 
logs to alert COOPER of a failed log-in attempt. The Internet Protocol (IP) filtering on the server was 
manual using a 515E straight IP block and PAGLIANO used Domain Name System (DNS) for inbound 
filtering. On the Dell PowerEdge 1950, PAGLIANO used a Kiwi Syslog server and tried to pull and 
review the firewall log files once a month. At some point, COOPER put PAGLIANO in contact with 

rom the USSS for a reason unknown to PAGLIANO[ ^ fold PAGLIANO to 

also perform outbound filtering of email traffic 


(U//F8UO) The back-up hard drive and mailboxes on Exchange server 1 were not encrypted. 
PAGLIANO wanted to move toward two-factor authentication using an RSA authentication server for all 
Remote Desktop Protocol (RDP) access on Exchange Server | because he thought it was a good practice. 
As atest, PAGLIANO installed it on his workstation, as well as COOPER's, but PAGLIANO did not end 
up implementing two-factor authentication and did not turn off RDP access. PAGLIANO stated there 
were no security breaches on Exchange Server 1, but there were a lot of BFAs. PAGLIANO knew the 
attempts were BF As instead of users forgetting their passwords because the user names in the BFA 
attempts weren't even close to any legitimate user name. PAGLIANO could not recall a specific country 
that would attempt an inordinate amount of BFAs. 


(U/AFOYO) In summer 2009, PAGLIANO noticed an account on Exchange server | called “Н.” 
PAGLIANO asked COOPER who this email account belonged to and COOPER stated it belonged to 
HILLARY CLINTON. PAGLIANO assumed the account was a personal email account. PAGLIANO 
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recalled the email account to be HDR. n. Later, after SYDNEY BLUMENTHAL's 
email account was hacked, HILLARY CLINTON's account changed to HROD 19(9cii 


(U//F&UO) In summer 209| ^ а] both Information 


Technology Specialists at the DOS, contacted PAGLIANO and asked him to come to the 7" floor in DOS 
Headquarters. Once there, PAGLIANO was asked if he was aware of the clintonemail.com domain and 
PAGLIANO replied in the affirmative. PAGLIANO recalled nothing further about this encounter. 
PAGLIANO relayed this incident {резе Seco x uae] and had a 
“visceral” reaction and didn't want to know anymore. In late 2009 or early 2010, reached 
out to PAGLIANO again and relayed to PAGLIANO that the use of a private email server by HILLARY 
CLINTON may be a federal records retention issue[ — —  elayed to PAGLIANO that he wanted 
to convey this to HILLARY CLINTON's inner circle, but could not reach them and asked if PAGLIANO 
ld relay this information. PAGLIANO then approached CHERYL MILLS in her office and relayed 
[concerns regarding federal records retention and the use of a private email server. 
PAGLIANO remembers MILLS replying that former Secretaries of State had done the same thing, to 
include COLIN POWELL. PAGLIANO thought he may have also mentioned the federal records retention 
issue with JUSTIN COOPER. Additionally, PAGLIANO recalled a third conversation with 
wher[ Jbrought up security concerns and stated that email transiting from a state.gov 
account to Exchange Server | should be through a Transport Layer Security (TLS) К = 2] 
stated to PAGLIANO that he wouldn't be surprised if classified information was being transmitted. 


(U//FO9UO) PAGLIANO stated the hardware used for Exchange Server | was paid for by the 
CLINTON family and through the 2008 presidential campaign and at least some of the hardware was 
acquired through US21 Computers. PAGLIANO believed most financial and acquisition matters 
regarding the CLINTONs would go through COOPER directly. PAGLIANO performed work for the 
CLINTONS without a contract and through contact with COOPER. COOPER wanted to do work under a 
retainer, but they settled on an hourly wage. 


(U//FOJO) In June 2011, PAGLIANO travelled to Chappaqua to perform maintenance and install 
new upgrades to Exchange Server 1. The discs began failing in the3 TB external hard drive in Exchange 
Server 1 and PAGLIANO replaced it with a CISCO NAS storage device. PAGLIANO chose CISCO 
because they make good products and he may have consulted US21 Computers as well. PAGLIANO 
allocated more than half of the storage space for back-ups of Exchange Server 1 and the rest for file 
storage. When uninstalling the 3 TB hard drive and installing the CISCO NAS, PAGLIANO did not move 
the contents from one to the other. PAGLIANO simply unplugged the USB connection for the 3TB hard 
drive and pointed the server back-ups tc ward the CISCO NAS. PAGLIANO also added memory to the 
Dell PowerEdge 1950, added a Gigabit switch, upgraded to a CISCO ASA 5500 firewall, off loaded 
syslogging to the CISCO NAS, bevght a CISCO botnet filter and CISCO Intrusion Prevention Service 
(IPS) and replaced the batteries on the UPS along with other various upgrades and maintenance. 
Additionally, PAGLIANO uneraded the BES from 5.0 to 6.0 and checked for any software patching. 
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(U//F9UO) In the Winter of 2011, the Internet Service Provider (ISP) providing internet service to 
the CLINTON residence in Chappaqua went down due to a storm. As a result, Exchange Server 1 was 
unable to process email. While the Internet was down, and to ensure email delivery, PAGLIANO advised 
COOPER to change the mail exchanger (MX) record for email accounts on Exchange Server 1 to point to 
Google. PAGLIANO wasn't certain if COOPER did this or who it was done for, but assumed it was done 
for HILLARY CLINTON and HUMA ABEDIN since they were the most concemed about lack of email 
delivery. 


(U//FGUO) Individuals with an email account on Exchange Server 1 could log into their account 
through any means available to them. PAGLIANO viewed his responsibilities as maintenance and 
operation of the server. PAGLIANO recalled HILLARY CLINTON used a BlackBerry as a mobile 
device, but could not recall the various handsets. PAGLIANO met with MONICA HANLEY at some 
point in 2011 or 2012 to configure a BlackBerry for HILLARY CLINTON, but could not recall any detail 
about the device 


(U//FO99) Upor Jeaving the CLINTON's ees and pursuant to a request foi — ] 


PAGLIANO recalled doing an export of 40 Gigabytes o email. This is the only export 
PAGLIANO could recall doing. PAGLIANO believed he may have done an export of email for 

but could not recall. PAGLIANO did recall doing an import of DOS contacts for 
HUMA ABEDIN onto Exchange Server 1 


(U//FGU9) PAGLIANO could not recall accessing the content of email on Exchange Server 1 and 
was never aware of any classified information residing on Exchange Server 1. 


(U//FOUOHn early 2013, PAGLIANO recalled the user limitations and reliability of Exchange 
Server 1 prompted discussions to search for another vendor to manage a CLINTON email exchange 
server. PAGLIANO recalled a conversation Wil: сс с] and COOPER about 
areer aspirations and what email requirements she may need. Eventually, MILLS and| 
weighed in relating to Exchange Server 1 and the end of HILLARY CLINTON's tenure as 


Secretary of State. At some point, an individual named began the process of finding a 
vendor to manage а new CLINTON email exchange server. PAGLIANO did not know, 
previously, or how she came to be involved with the search for a vendor. Eventually. showed 


PAGLIANO a presentation detailing three vendors and their capabilities. PAGLIANO recommended a 
company called Platte River Networks (PRN). Ultimately, PAGLIANO recalled the decision being with 
a she chose PRN 


(П/# ӨНӨ) Once the decision was made to go with PRN, PAGLIANO recalled communicating 


with PRN employee] related to the transition from Exchange Server 1 to the server 
PRN was going to use. Around this time, PAGLIANO was already 4 to 5 months into a new job as an IT 
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specialist at GARTNER. PAGLIANO gd sd administrator access to Exchange Server 1 as 
well as user names and passwords to individual email accounts. PAGLIANO recalled talking to 

once or twice and possibly[ ^ 1] In order to prepare Exchange Server 1 
for the transition to PRN, PAGLIANO also “trimmed” mailboxes and cleared out white space. 
PAGLIANO described this as a maintenance process of reclaiming space from old mailboxes, like in the 
example o 


(U//F8GUO) Based on conversations he had or was aware of, PAGLIANO recalled knowing that 
PRN was going to use a DATTO service for backing up their server, a CloudJacket device for network 
protection, and potentially, two-factor authentication ^  ]was responsible for establishing the contract 
of services PRN was going to implement and ensure they were implemented. 


(U//FGUO) PAGLIANO was shown an email dated January 30, 2014 where a user list was 
populated by Platte River Networks regarding their management of a CLINTON email server, Regarding 
the email, PAGLIANO did not recognize the mailbox *HRC Archive." PAGLIANO stated after PRN 
took control of managing an email server for the CLINTONS, he had no visibility into the server or the 
mailboxes. 


(U//EGUO) In what PAGLIANO remembered as the fall of 2013, MILLS called PAGLIANO and 
inquired about the effectiveness of two types of software for wiping computer data, but PAGLIANO 
could not recall the names of the software. PAGLIANO discussed the difference between "bit" wiping 
and deleting with MILLS. PAGLIANO inferred from his conversation with MILLS that PRN was going 
to excise data. PAGLIANO recalled using Boot and Nuke software when deleting and repurposing 
computers while working on HILLARY CLINTON's 2008 presidential campaign, but didn' t recall if he 
discussed that with MILLS. 


(U//FG9O) In July 2014, PAGLIANO had a conference call with MILLS апа Део 
discuss an archive of HILLARY CLINTON emails from her time as Secretary of State. PAGLIANO 
recalled that MILLS and were trying to determine why a gap existed in HILLARY 
CLINTON's emails between January 2009 and March 2009. In separate conversations with COOPER, 
PAGLIANO understood that CLINTON used a BlackBerry email address before hosting her account on 
Exchange Server 1 and that explained the gap from January 2009 to March 2009. PAGLIANO could not 
recall a conversation with MILLS Ыс с 7 July 2014. 


(U//FO€89) In Spring 2015, MILLS asked PAGLIANO if he would mind talking to DAVID 
KENDALL from Williams & Connolly LLP. PAGLIANO agreed to talk to KENDALL and described the 
interaction as a shorter version of PAGLIANO's conversation with FBI agents as memorialized herein 
PAGLIANO stated there is nothing he told KENDALL that he didn't also relay to the interviewing FBI 
agents 
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(U//FGUO) At this point in the interview, FBI agents displayed documents to PAGLIANO that 
were Bates stamped as an identifying mark. PAGLIANO was asked questions as it pertained to each 
respective document. The following was provided by PAGLIANO: 


(U//F9UO) After viewing a document marked HC-001, PAGLIANO stated the credit of 
$5,000.00 to his account was a payment, including expenses, for his work in March 2009 setting up 
Exchange Server 1. The payment of $8,350.83 in June 2011 was for his previously described maintenance 
work on Exchange Server 1, to include expenses. 


(Ц/Ж ӨНӨ» After viewing a document marked HC-014, PAGLIANO stated the line item 
*1/11/2011 Conference call with Security team" was the previously described communication with 
LLL. ]related to outbound filtering. PAGLIANO stated] was an individual he worked with at b6 
US21 Computers. PAGLIANO recalled HILLARY CLINTON turned off Bluetooth capability on her BIG 
BlackBerry, while COOPER, and posibl| — ] enabled Bluetooth on their handsets. 


UTS PAGLIANO stated[____] referred to in a document marked HC-023, wa[  ] ps 


ътс 


(U/FGUO) After viewing a document marked HC-008, PAGLIANO stated the “Mailbox kick off” 
indicated in the invoice was related to the previously described work exporting[ ^ ]mailbox. bé 
b7C 
(U//FO'3O) After viewing a document marked HC-004, PAGLIANO stated the iPad referred to in 
the invoice belonged to HILLARY CLINTON. PAGLIANO did not configure the iPad and could not 
recall when HILLARY CLINTON started using it, nor any other details related to the iPad. 


(U//FO3O) After viewing a document marked HC-010, PAGLIANO stated in March 2013, 
MILLS requested an analysis of Exchange Server 1. PAGLIANO recalled giving Exchange Server 1 a B+ 
grade and conveyed in his analysis the limitations of Exchange Server 1 and recommendations for a more 
robust email system. PAGLIANO relayed the greatest liability of Exchange Server 1 to be reliability and 
referenced the incidents in which the ISP lost power and was unable to provide internet service to the 
residence in Chappaqua. PAGLIANO had always been against housing a server in a residential basement 
and preferred the security and reliability of an established data center. MILLS did not have an email 
account on Exchange Server 1 and used state.gov and gmail for email exchange 


(U//FOUO) After viewing a document marked HC-002, PAGLIANO stated the virtual private 
network (VPN) referred to in the invoice was not for users of Exchange Server 1 and just for 
administrator use. PAGLIANO stated he installed the IPS at the same time the CISCO ASA firewall went 
in place in June 2011, PAGLIANO fine tuned the IPS over time, fluctuating between turning logging on 
and off as needed. 
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(U/AFOUO) The notes of the interview and all aforementioned documents displayed to 
PAGLIANO will be stored in a FD340 envelope and filed with the captioned investigation 
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(U//Fe86) On June 21, 2016, BRYAN PAGLIANO, was interviewed 
telephonically by Federal Bureau of Investigation (FBI) Special Agents 
(SA) and Information Technology 
Specialist/Forensic Examiner Also on the call for the 
interview were AkinGump attorneys Connor Mullin, 
Counsel, Mark MacDougall, Partner and Additionally, 

from the U.S. Department of Justice was also on the 
call. After being advised of the identity of the interviewing Agents, 
and the nature of the interview, PAGLIANO provided the following 
information: 


(U//FeBe) PAGLIANO did not work on the Apple email server, 
set-up by JUSTIN COOPER for WILLIAM CLINTON aides, and therefore, has 
no information regarding a Secure Socket Layer (SSL) certificate 
registered for the Apple server. PAGLIANO did go through the "full 
registration" process for establishing an SSL certificate on the 
server he later built, which enabled email to be encrypted while in 
transit. 


(U//P686) Based on a request from COOPER, PAGLIANO built an 
email server in early 2009 in HILLARY CLINTON's 2008 presidential 
campaign space on K street. PAGLIANO could not recall the exact 
address of the building. Once built, PAGLIANO rented a minivan and 
drove to Chappaqua, New York to install the email server in the 
CLINTON residence. PAGLIANO could not recall any existing computer 
systems at the Chappaqua residence, other than the Apple server 
previously described to the FBI. When designing the network for the 
server, PAGLIANO left the CLINTON's home internet network separate 
from the server - leaving it outside his firewall. 
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(U//#988) PAGLIANO recalled being given a list of user names 
and passwords that COOPER asked to be transferred from COOPER's Apple 
server to PAGLIANO's system. PAGLIANO did not recall transferring an 
account for HILLARY CLINTON and does not know how her account was 
installed on the server he built. PAGLIANO installed an IP-based 
printer on this email system with the express intent of allowing the 
CLINTON office in Harlem to print at the Chappaqua residence. PAGLIANO 
installed regular updates to software on the email server using "auto 
patching” every night. PAGLIANO did some work to experiment with two- 
factor authentication, but did not implement it on the server because 
it would have been difficult to administer. PAGLIANO changed the name 
of the built-in Administrator account and eventually disabled it. 


(U/^F9H9) PAGLIANO could not recall saving a file called 
"netstat.txt" When PAGLIANO received a recommendation to do outbound 
IP filtering from at the United States Secret Service, he bé 
implemented the change. PC 


(0/ / ӨӨӨ) Around January 2011, PAGLIANO recalled a brute 
force attack (BFA) on the server where COOPER was receiving failed 
log-in attempt notifications on his email. Because COOPER could not 
reach PAGLIANO, COOPER “panicked” and shut down the server. PAGLIANO 
recalled nothing abnormal about this BFA and eventually trained COOPER 
to insert IP blocks. PAGLIANO made it clear to COOPER he could not 
administer the server on a day-to-day basis. 


(U//Fee6) After a recommendation By [7 —— —] an Й 
employee at STATE DEPARTMENT (hereafter, STATE) to implement Transport 
Layer Security (TLS) between the CLINTON email server and STATE 
servers, PAGLIANO did not implement TLS. PAGLIANO understood the 
CLINTON email server to be a personal email server and did not see a 
reason for encryption. 


(U//#686) In early 2013, PAGLIANO found employment at 
GARTNER and conversations began between CHERYL на be 
and pertaining to hiring a third-party company to Bie 
administer a CLINTON email server. PAGLIANO could not recall when he 
gave access to his server to from PLATTE RIVER NETWORKS 
(PRN). Once PAGLIANO did grant access to PAGLIANO did no 
utility work on the server and was not monitoring it. Although he 
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could not remember a specific date, PAGLIANO believed the last time he 
accessed the server was around March of 2013. 


(U//EGUG) Notes of the interview will be maintained in a FD340 
envelope. 
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as interviewed in her office at м] 
Investigation (FBI) Special Agents (SA 


Washington, D.C., by Federal Bureau of 
Ya А ЕИ 
explained the interview was voluntary ап 


‘ould stop the interview at anytime. After 
being advised of the identity of the interviewing agents, and the nature of the Wee] 


provided the following information 


(цу ене] }ичсрае4 in daily 8:45am meetings with the Secretary of State and 
her executive staff_ CLINTON was not always present at said meetings, as she traveled quite a bit. 
However, assessed she attended meetings wherein CLINTON was present approximately 
three to six times a week when CLINTON was in town. 


(U//FOUO did not have a relationship with CLINTON prior t 
DoS employment reported directly to CLINTON, but did not email CLINTON directly 
until six to eight months after she began working at Dos[  ]wa not initially provided 
CLINTON! s email address, so when she wanted to send or forward a message to CLINTON, she would 
route it through HUMA ABEDIN. At some point in the first six to eight months of her employment at 
lied CLINTON responding to one of the messages she forwarded up directly. At 
sked ABEDIN if it was okay to go direct with CLINTON, and was granted the 
"privilege." explained the privilege of emailing CLINTON direct was not a privilege she 
used lightly. While| did not have a history of Government Service, she thought it was 
normal for someone in CLINTON's position to have a “gatekeeper system" in place. 


Investigation on __ 12/16/2015 at Washington, D.C. 
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weveo l koud not recall if the emails she directly sent to and from CLINTON 
were on CLINTON's DoS or private email account] ва not recall seeing CLINTON' s 


actual email address. Rather, when received or responded to emails from CLINTON, she 
recalled seeing a single initial. believed she recalled seeing “S” as the name of the sender 
when she received direct CLINTON emails during her time at DoS, lend other DoS 


executives would refer to CLINTON as “sf sd noted that although she is no longer at DoS, 
she still maintains email contact with CLINTON and now receives emails from CLINTON where the 
name of the sender is “H.” had no knowledge CLINTON was using her own private 
server until it was reported in the media 


(U//FOJ9O d a Secret clearance while she was at DoS, but rarely worked in the 
classified realm. Whil received access to and training on th of DoS' s classified 
computer systems, she hardly accessed DoS' classified system id not recall ever using 
her DoS classified email account 


been more likely to use his DoS classified email account 
[сз оул тше entirely worked off the DoS' classified system 


(uuFege[ Jas asked to review an email dated 9/12/2009 wherein] 
sent an email titled “For S — for discussion on Afghanistan tomorrow,” from her unclassified DoS email 
account to CHERYL D. MILLS and JACOB J. SULLIVAN's unclassified DoS email accounts. 
ABEDIN, ad[ — Мете carbon copied on the email. While reading through the 
at one point stated “good Lord," and further stated that the information contained in 
writing was also referenced in the first line of the email). 


email 
the email was 


(u/Fege[ ^ iid not recall specifically sending the 9/12/2009 email to MILLS and 
SULLIVAN, but mentioned she would not have known the information contained in th, 
email. There Afghanistan Review was ongoing at the time of the 9/12/2009 email, rri 
recalled strong conflicting opinions concerning the role corruption played in the Afghan political strategy. 
L likely sd Re information in a separate email, which 
have edited before sending to MILLS and SULLIVAN Lo ety spoke t 


phone or in person about the matter befor| ____ ]етайей the information t 


(U/AF6U8) After reading the 9/12/2009 email ladmitted she was a bit “shocked 
when she read over the paragraphs labeled #5 and #6.” stated she “wondered to what 
extent she read... thought through carefully" before she sen: email on to MILLS and 
SULLIVAN, SULLIVAN had no idea what was meant by “Marja” Op as stated in the paragraph #5, but 
explained she believer |was proposing ideas rather than revealing ten] 0 further 
went on to say she wouldn't have recommended kinetic action. 
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ould talk to 
s a back channel to 
get information to CLINTON. as a “bold thinker.” 

saw her role as ensuring CLINTON received a wide range of viewpoints on various topics. 


(U//FOUO) Agents also аке] ifshe recalled a 6/3/2011 email she sent regarding a 
hacking of Google email accounts, in which she recommended using the information as a platform for 
discussing issues with the DoS Information Technology system.[__________ immediately 
remembered the email and explained she initially thought it was why the FBI wanted to speak with her. 


(шж өнө] ^ |] i ing advised or instructed against using a personal 
email account or personal devices. used her DoS assigned Blackberry. However, she was 


assigned a DoS Dell computer, which was very dated, so she opted to use her personal laptop when she 
was pais] s also issued a fob for which to remotely sign onto DoS systems. 
While| did use the fob on occasions to ге! ien i e DoS system, she explained 
the system was slow and would shut down while in use. ho resides SS 


[С would often sign into and work off o etwork from her home, and transfer 
information she needed back over to DoS systems 


(U//F8U9) SULLIVAN was always operating off of his DoS Blackberry, sf ] 
doubted he ever used a personal account for DoS business. However, MILLS would sometimes send very 
early morning emails to} around Sam) that were sent from a personal Gmail account 

believed was f an fe ela not recall the specific 
content of emails she received from MILLS' personal email account, but believed their content was 
mainly instructional 


(u/FeHe[ ^  jeoud not recall an instance where a conversation (email or otherwise) 
was moved from an unclassified to classified space. It would be more common for a conversation to turn 
"confidential" and the circle of participants would dwindle in size to accommodate sensitivities, rather 
than change the venue of the conversation. 


жөнө] ë E] opined that most policy and strategy discussions would be considered 
unclassified, acknowledging that some of the participants in policy and strategy discussions may have 
additional details concerning sources and methods that would have come from classified channels 


(U//F8GUO) At the conclusion of the interview old agents she had not mentioned 
the interview to CLINTON or any of contacts from DoS. further asked if she was allowed 
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to tell SULLIVAN and/or CLINTON she spoke with the FBI, and explained she was concerned they 
could be upset ke with the FBI without telling them. Agents explained that while they 
cannot prohibi from referencing the interview, they would prefer| use 
discretion when discussing the matter, as to prevent unnecessary information from leaking into the press. 


umeo ^ was not previously interviewed by DoS or any other entity related to 
the topics discussed during this interview 


(ЦШ/ ӨНӨ) Agent notes are maintained in a 1A. 
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ed by 
Federal at the law 
offices o! Washington DC. Also present for the interview 


and Department of Justice (DoJ) 
After being advised of the 
provided the following 


Counterintelligence and Export Control Sectioi 
identities of the interviewing agents, and the purpose of the interview,| 
information 


(U//FO8'80) In хз] оште Меге ће continues to serve 
as the Managing Director. Prior to foundin Беа former 


also served in various 
with officials from the Department of State (DoS) 
шш. with DoS. 

weekly while at he was а further stated there was close coordination between те and 


DoS on all levels coordinated more frequently with DoS during hid tenure, asit was 
necessary to coordinate with DoS on everything that happened “down range." 


postionson| — ^ 1 | 
(urone k 


during his tenure at both € 


oordinated frequent! 


rimary DoS contacts while he was both a[ аа — included CHERYL 
and JACOB SULLIVAN С “also occasionally communicated 
and some U.S. Ambassadors when he was assigned to 


U//FOUO) Most o[ Jeontact with DoS while at both[ Jand ]was via telephone or 
email had classified and unclassified telephones and email systems available on his desk at both 
L Jana Whern[ ^ bigned on to his computers a[ Jhe was directed to a classified network 
and would have to switch over to| unclassified network if he wanted to communicate on an 
open/unclassified system, whereas whe: signed on to hi[ ^ computer. the system automatically 
defaulted to the unclassified network. 


u/resue|  kould not recall what email account was synced to hiS[ issued Blackberry. 


Blackberry while a[ Jwas synced to his unclassified account 
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(uuredel þes provided a STE and safe for home use during hif — ]enure. Be 
explained that he did not utilize the safe to store documents, but occasionally used the STE. did 576 
not leave the STE plugged in at all times, rather he would wait for someone to contact him on ап 
unclassified line and request a secure call from his home before he would physically plug in the STE 

(U//F889) he attended weekly lunch meetings b6 
with then Secretary of State HILLARY CLINTON, an wie 

le CLINTON also met regularly at National Security Council (NSC) Principal 
Committee (PC) meetings whil 
with the CLINTON family, as he served as President WILLIAM J. CLINTON 's in the 
1990's. 

(reno ever emailed directly with CLINTON. He was not aware of the email b6 
account CLINTON w. w. wi wi g off of a private BIG 
server. According t would not have 
utilized email as a means to communicate with CLINTON. I wanted to contact or convey a 
message to CLINTON. would subsequently contact the aforementioned DoS senior staff (MILLS, 
SULLIVAN, or| to relay the appropriate information, 

(U//FO'UO) Agents asked o review an email dated 3/21/2009 and with the subject line 

С] The email was sent from to *H" (identified as CLINTON's 
ersonal email account). The email be 
b7C 
b3 per CIA 
(U//FOUO) Agents asked to review an email dated 12/30/2009 and with the subject line E 
LLL The email was sent se der CLINTON, and referenced information| ]claimed to 579 
receive fom — ] After reading the email, explained he recalled the incident referenced in the 
email and remembered| 
when the incident occurred. called being contacted by an m ^ Assistant (EA) 
Last Name Unknown (LNU) who reported the incident in Afghanistan [subsequently 
contacted| ho requested| notify the President, Vice President, Chairman of the Joint 


Chiefs of Staff, Secretary of State, and ux K of Defense. [ee eee 
contained some anecdotes about the incident. шшш”? not recall if he received the information from 
SECRET 
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С му via secure phone ee or on an open line. [С оша not recall the specifics concerning 


how he relayed the incident to but stated most of the calls he made that day concerning the 
incident were likely on an unclassified line due to the emergency of the situation. He described his role in 
the call as contacting his counterparts to relay a brief synopsis of the incident with the caveat that his 
counterparts should “give their boss a heads up.” further explained he may have participated in 
follow up calls on the STE, but could not say for sure either way. 


(U//FOUO) Agents also showed[ — an email exchange dated 2/ pan with the subject of 
email.” In the email chain SULLIVAN zos — Ju ask fo — 1] email address 
eplied а] email wa[ —— [gemail.com. Thereafter, SULLIVAN asked if this 


email account was the one that used for work and confirmed that it was. After reviewing 
the email L dexpt lained that he primarily used his ripe nd email accounts 
respectively for work purposes. However, he noted th may have used| @gmail.com on 
occasions when he could not access his official Тот unclassified emails. 


(u/regey |емемей another email dated 11/20/2010 with ake et us С 
Israel,” in which he sent the email to SULLIVAN on both LLIVAN's 
DoS unclassified email account. Also on the receiving line of the email v were and 

via their “nsc.eop.gov” email accounts. L Jeouia not recall why he would have 
sent the email to SULLIVAN' s gmail account, but stated he would normally email SULLIVAN via his 
DoSaccount[ ^ Jdid not recall ever receiving instruction from SULLIVAN or any DoS employee 
regarding contact on a gmail account rather than their DoS email. L fisted both his and 
@gmail.com accounts at the bottom of the email because it provided multiple means for people to contact 
him while he was on travel in the event his work email was not available. 


(U//FOUO) Agents лына a fifth email dated 09/11/2012 and with the subject line 
“Libya.” [Note: The email shown t was in a redacted format based on a DoS Freedom of 
Information Act (FOIA) response to Judicial Watch]. After reviewi 
explained there was a series of meeting on 9/11/2012 in 
surrounding Benghazi. The арив referenced what referred to as a deployment 
meeting. There are three types of deployment meetings according to. 1. Deployment orders, which 
is the standard process of determining who needs to go where 2. “Careful hurry up deployment,” which 
takes place over the course of a couple of days and is quicker than the standard process 3. "On the fly 
quick reaction" deployment, which is used only in emergency situations. The only timeL____ could 
recall the “on the fly reaction deployment” happening was after Benghazi 


ng the redacted email, 
ffice concerning the events 


(u/rese) was asked to review a sixth email dated 10/30/2012 with the subject line "This 


am Green on Blue." [Note:The email shown t as in a redacted format based on a DoS FOIA 
response]. 
referenced said email 


responses, 


explained he sent the email to rapidly coordinate the Public Affairs 
land DoS in regards to the incident referenced in the email EN: 
were the respective Public Affairs contacts at DoS and 
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U/FOUO 
bé 
b7c 
bé 
b7c 
ecause he did not even know if that statement was true. bl per CIA 
b3 
тоно E a have any concerns regarding how DoS handled classified information e 
during his tenure at either o[ ] m 
(Ш/РӨНӨ]  Jndicated he would be available for re-contact if needed. 
b6 
(U//FOCO) A copy of the original interview notes and the referenced emails and article are b7C 
attached in a 1A envelope 
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bl 


i 2 Rev ММО) 
b3 per CIA 
vas shown ac ай email по] uer GIA 
with the subjec After reviewing the email бе provided that appeared to be 53 E 
pee K M d 
vas shown a copy of an email о] 
with the subject After reviewing the email he provided that the emai be bl per CIA 
classified but that he was not surprised that DOS had sent it on an unclassified channel | further — P2 
noted that the DOS unclassified email system had previously been penetrated by а foreign adversary. 
was shown a copy of an email from 
zvjewing the e maill _____Ь ated that his true name, and that o 
ewing the en : tated that e пате, ai at of bl per CIA 
should not have been included in an unclassified email. b3 
sified. They were conveyed from the 
CLA to DOS via a cable that included a tear line below which the approved talking points were provided. 
vas shown a copy of an email fre 
Iwas shown а сору of An email кў] bl per CIA 
хир) After reviewing the ema b3 
o assess if the talking points 
included in the body of the email were classified or not. 
py of an email from 
bl per CIA 
b3 
was shown а, 
ing ihe ema 
bl per CIA 
b3 
concluded the interview by stating that DOS has 
shown an increased tendency to communicate via email. He believed that they did this for simplicity, to 
avoid unauthorized disclosures such as Wikileaks, and to prevent other USG partners from seeing their bl per CIA 
ack channel" discussi continued to say that the personnel at DOS were experienced and b3 
knew that this information was Classified. However, they did it anyways and their actions hart the CIA 
and other ageucies whose equities were conveyed in the emails. 
Med IN А bl 
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(UOUE А copy of the original interview notes and referenced documents is enclosed ina ТА 
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t thc f i Washi 
MORELL counsel J 


served in a variety or ile ol in 
2010. MORELL was the DD from Ma 

Acting Director on two occasions. The first time was in 2011 when LEON PANE 
was in late 2012 when DAVID PETRAEUS resigned. 


h he served as the 
ГА left and the second 


WEOE As DD. MORELL had reguiar interaction with the Deputy Secretary of State 
WILLIAM BURNS during the daily Deputies meeting at the White House. MOREL. would also attend 
or have secure telephonic conversations, with BURNS or be 


nig atthe arunent ol State (DoS EG 
10 discuss inter-agency affairs. MORELL never communicated directly with the 


Secretary of State (Secretary). 


(UU PO) MORELI, did not recall ever having direct communications with JAKE SULLIVAN. 
because SULLIVAN did not attend the Deputies mecting. Nor did he have direct communications with 
IRYL MILLS or HUMA ABEDIN. 


POHE) MORELE never emailed the Secretary directly and had во knowledge that she was 
using a private email uccount and server. 


bl per CIA 
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bl 
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PUI MS (Ree, 10-6235) 


omina 
a bl per CIA 
b3 
MORELI. stated that he understood why the email would be considered classified not believe 
that the email would jeopardize any sources, methods, or otherwise compromise national security. 
bl per CIA 


b3 


(S/F) MORELL was shawn a copy of an email chain from April of 2011 with the subject “Scots 
police, UK govt te meet over Libyan detector (Reuters)." MORELL recalled the matter referenced in the 
email s provided the Following context At the time of the email the Libyan Civil war was raging and 
still in power. Part of the U.S. strategy at that time was to induce | the 
de iion of of high ranking ofici als from 1. ibyo. In ше email chain BURNS expressed tha 
future detections 


bl per CIA 
b3 


would say that the 
content is clussitied because} lowever, 
MORELL did not fee! that the disefosure of this information would cause "horrible" damage. 


ORELE was shown а сору or smail chains бо] PL per CIA 
С ith the subject MORELL stated that the email dis п 53 
шц be classified as it 


absolutely clear that they are referencing 
RELI. speculated та SU 
as he never snak ч 


LIVAN got m informati 


AORE L L stated Pe it was clear that they were bl per CIA 
b3 


[it —— шш; 
disc wsng — 1 | cleved that the email was classified г 


operational activities d that the content of the email did not “give much away" 
bur he conceded that th information could potentially be damaging to the operation. 


MORELL was shown a copy of an email chain from] bi pes Cra 
hvith the subjec pa 
MORELL stated that it was clear that they were disc nnd the email was likely 
classified. 
bl 
b3 
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$ Mar ‚Оп 02172010 Page __ 
MORELL _suguested that the interviewing agents talk with leadershij trom the b3 per CIA 
land with leadership from uos ыз another 


ereneed emails. 
(UZFOUOG) A copy of the original interview notes and the NDA signed by Lo S b6 
enclosed ju a EA envelope, bic 
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Project Manager, Platte River 
was interviewed by 


Networks (PRN), office phone 
Federal Bureau of Investigation (FBI) Special Agent (SA 
Also present for the interview was| 
Department of Justice (DOJ) Attorney 
interviewing agents and the nature of the interview. provided the following 
(U/FOYO) LLL е with the email server project for WILLIAM CLINTON and 
HILLARY CLINTON, under the account name CESC, involved transporting and installing hardware. He 
did not serve as the Project Manager, his normal job function at PRN. His first task for the project was to 
pick up the CESC server and support devices in use prior to PRN being awarded the contract for the 
project. The server and support devices were located at the CLINTON residence in Chappaqua, NY. In 
June 2013 traveled to New York and drove a rental car to the CLINTON residence. 
contact at theresidence[ —— ]Last Name Unknown (LNU), escorted to 
the basement where the equipment waslocated[ ^ ]powered down the equipment and took a 
Dell PowerEdge 1950 BlackBerry Enterprise Server (BES), Dell PowerEdge 2900 email server (hereafter, 
predecessor server), Cisco NSS 324 Network Attached Storage Device (NAS), and an external USB hard 
drive, but left the existing firewall and switch. 


(uFeso[  ]then transported the equipment to an Equinix datacenter in Secaucus, 
NJ where he reconnected the equipment in the same manner in which it was connected at the CLINTON 
residence. The goal was to get CESC users back online quickly LL  — And 
who was working remotely, then started incorporating new equipment PRN purchased for the CESC 
project, m not recall if he set it up before or after transporting the server. The new 
equipment consisted of a Dell PowerEdge 620 server running multiple virtual machines, two new 
PowerConnect switches, two new Fortinet firewalls, and a DATTO backup device. During this period of 
time, the predecessor server and new PRN server (hereafter, PRN server) co-existed. The predecessor 
server had the NAS connected, but it did not appear to be configured for storing any data. The PRN 
server had a DATTO backup appliance connected to it. After 2-3 deu] ema Equinix 
and did not participate in the day-to-day management of the CESC account. Those duties were handled 
remotely рс | Several days later, а CloudJacket intrusion prevention device was installed by 
technicians at Equinix. The CloudJacket was designed to alert PRN and prevent intrusions into the PRN 
server. 


Investigation оп — 09/15/2015 at Denver. Colorado 
File ¢ ро Date dictated — N/A. 
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(Ш/РӨБӘ) In or about March 2015, mmunicated with CHERYL MILLS 
regarding any existing backups of the CESC email server and the state of the predecessor server. MILLS 
requested an audit of the existing equipment, but did not dea he delete or alter any data 
found[ ^ —  ]raveled to Equinix datacenter in Secaucus, NJ to conduct an onsite review of the 
equipment, PRN had migrated all accounts off of the predecessor server by this time, therefore it 
contained no data. [heaved the NAS and external USB hard drive brought from the 
CLINTON residence as part of the initial transport of equipment. Neither contained any data. While 
there hiso took steps to increase security on the system as a result of media articles 
identifying the existence of the private email server used by the CLINTONS. PRN took these steps 
without direction from CESC. 


(О/А Ә-Ә) None of the Internet Protocol (IP) notification] reviewed from the 
CloudJacket device used as part of the security infrastructure for the CESC account were abnormal. All 
were alerts and some resulted in IP addresses being blocked from accessing the equipment 
does not believe any nefarious actors got into the system 


(U/£FO'3O) In or about August 2015[ Jtraveled to the Equinix datacenter in 
Secaucus, NJ to turn over the predecessor server to the FBI. Prior to turning over the server, 
LLL powered on the server to check for proprietary PRN software and license copies of other 


software purchased by PRN[ —— ресаПей removing Magic ISO software because it was 
expensive and PRN pays for license fees for each copy it uses p] review of the predecessor 


server was not requested by CESC 
u/regey[ — hever heard anyone from CESC discuss classified information. 


as never asked by anyone from CESC to delete or destroy anything; however, PRN would 
not have knowledge of individual users deleting content from their accounts. 
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Project Manager, Platte River 


Networks (PRN), office phone} 
Federal Bureau of Investigation (FBI) Special Agent (SA 
С hat the offices of Platte River Networks, 5700 Washington Street, Denver, CO. Also present for 
the interview were SA Information Technology Specialist/Forensic o ЫЕ — 
nd Department of Justice (DOJ) Attorne 


After being advised of the identity of the interviewing agents and the nature of the interview, 
rovided the following: 


(U/Fege)[ — handled the technical infrastructure related to the contract PRN had 
with the Clinton Executive Services Corporation (CESC). an the day to day 
operations and most direct interactions with the client, including managing and maintaining the Microsoft 
Exchange email server and associated equipment (collectively hereafter, Server). 


(U//F9U9) In March 2015, the CESC requested PRN conduct a complete inventory of data 
backups and all equipment in PRN's possession related to the services provided to CESC. [eee 
does not recall how or who from CESC communicated this request. In response to the request, 

raveled to the Equinix facility in Secaucus, NJ where the Server housing CESC' s data was 
located. In addition to the currently operating equipment, found a Network Attached 
Storage (NAS) device and an external hard drive that were disconnected. He connected them and 


ontent, but neither contained any data, so he disconnected them before leaving. 
did not find any unexpected backups during this trip. 


rovo ————— aguely recalled the name[ ffrom Security Pursuit, but did 


not know why it was familiar to him. He did not recall implementing any new security protocols in the 
March 2015 timeframe, bu[ fiia conduct a high level security check of the Server 


(U/reue[ did not recall a backup device of HILLARY CLINTON's connecting 
via IMAP/SMTP to the Server 


Investigation on __02/18/2016 at Denver. Colorado 
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(ж ене  Jnever deleted, nor was he asked to delete the mailbox *hrcarchive" from 
the Server. He never discussed deleting content, creating pst files, exports, or shredding of .pst files with b6 


LL or anyone else. Aakionaly [Fis nti with a program called BleachBit b7C 
However, prior to turning over the Server to the FBI, emoved PRN system tools such as an 


ISO mounter and, possibly, a monitoring tool from Level Platforms or LabTech 
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(U//F889) On June 10, 2016, JOHN BENTEL, Date of Birth lwas interviewed 

1 1 at the 
ashington DC. Present for the interview was b6 
BENTEL's counsel Partner, and| J Special Counsel. As well ъс 


а from the Department of Justice (DoJ) Counterintelligence and Export Control Section. 
Prior to the interview BENTEL wa: After being advised of the identities 


of the interviewing agents, and the purpose of the interview, BENTEL provided the following 
information 


(U//FO'3O) BENTEL served at the US Department of State (DOS) for 39 years before retiring in 
2012. Most recently, BENTEL was the Director of the Executive Secretariat Information Resource 
Management (S/ES-IRM) from 2008 until 2012. In this position he reported to LEWIS LUKENS and 


then to TULINABO (Т oximately 85 people were under BENTEL' s supervision, b6 
including two deputies mH PIC 


(U//F8'8O) BENTEL did not learn that HILLARY CLINTON was using a private email server 
while she was at DOS until it came out in the press last year. He had no knowledge of the server while he 
was at DOS. BENTEL met BRYAN PAGLIANO while he was at DOS and knew that he worked for IRM 
but he did not know that he was also providing support to the CLINTON server 


U//Feve) BENTEL was shown а созу of an email sent коо BENTEL, xu 


and lon March 17, 2009, with the subject “Secretary 
Residential Installation Hotwash." BENTEL provided tha: as responsible for setting up secure 
communications in CLINTON's office and residence, and that as a contractor in| 


section. After reviewing the email and its attachment, BENTEL stated that he did not recall the email and 
that he might not have read the email originally because he and his two deputies functioned as *a 
collective." BENTEL stated that the attachment appeared to be a summary of the communication 
equipment in CLINTON 's residence at the start of her tenure. BENTEL did not know what the "Server: 
Basement Telephone Closet" listed in the attachment referred to. He then speculated that it might be a 
server for telephones. Upon further questioning, BENTEL provided that he did not know if DOS used or 
installed servers to support its telephone equipment. 


(U//FG89) BENTEL was shown an email sent from MONICA HANLEY to HUMA ABEDIN 
on August 30, 2011 with the subject "HRC blackberry" that referenced a discussion between HANLEY 


Investigation оп — 6/10/2016 at Washington, D.C. 
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and BENTEL. Upon reviewing the document BENTEL provided that he did not recall the email and that 

he would not have used the term “chapp server." Furthermore, he did not recall CLINTON losing access 

to her email following Hurricane Irene or any related discussions. BENTEL explained that he did not 

have a lot of direct interaction with CLINTONV's staff and that communication issues would likely be b6 


handled ЫС от the “tech team." pIe 


(U//F88O) BENTEL was aware of the Office of Inspector General (OIG) report from May of 
2016 in which it was reported that subordinates raised concerns about the Secretary's server to BENTEL 
in 2010 and he instructed them not to discuss the matter any further. BENTEL denied that anybody had 
raised such concerns to him. He further stated that the account provided by the OIG report was 
inconsistent with his open and welcoming management style. 


(U//FO'U9O) BENTEL stated that he did not know CLINTON was using a personal email account 
for DOS business until after it was released in the papers. BENTEL clarified he knew that CLINTON had 
a personal email account but that he did not know that she was using it for work related matters. BENTEL 
did not know if CLINTON had a DOS issued email account. 


(U//FOUO) BENTEL was shown an email that he sent to MONICA HANLEY on August 30, 
2011 with the subject “Re: S berry.” The email discusses a DOS issued email account, 
SSHRC @state.gov, which had been previously established for CLINTON. In the email, BENTEL wrote 
that emails on the account would be subject to Freedom of Information Act (FOIA) searches. Upon 
reviewing the email, BENTEL stated that he did not recall the email exchange or the details surrounding 
the use of SSHRC@state. gov, noting that the account was likely set up by the system administrator. 
BENTEL included the caveat about FOIA to make sure that HANLEY was aware of FOIA and that any 
personal messages on the account would also be subjected to FOIA requests. BENTEL stated his group 
was not directly responsible for FOIA related matters and that the appropriate contact for FOIA matters 
within S/ES-IRM wa: 


b6 
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(О/ҒӨЪЮ) BENTEL was aware of the State Messaging Archive Retrieval Toolset (SMART) and 
said it was not used by S/ES-IRM during CLINTON's tenure. BENTEL speculated that it was not rolled 
out to S/ES-IRM at that time because it was a new system and they wanted to work out any bugs before 
giving it to the executives. BENTEL stated that STEPHEN MULL would have made the final decision on 
rolling out SMART to S/ES-IRM 


(U//F8U9) А copy of the original interview notes and referenced documents are attached in a 1A 
envelope. 
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21, 2015, COLIN POWELL, office addes| sd 


was interviewed at his residence b 


Federal Bureau of Investigation (FBI) Special Age; 

Also present during the interview was 
After being advised of the identity of the interviewing agents and the nature of the interview, POWELL 
rovided the following 


(Ш/ ӨНӨ) In his book, /t Worked for Me: In Life and Leadership, POWELL wrote a chapter 
called Brainware outlining his efforts to modernize computer systems at the US Department of State, 
ereafter State. When he was sworn in as Secretary of State in 2001, one of the largest problems at State 
was outdated Information Technology (IT) systems. At the time, State and the Central Intelligence 
Agency (CIA) would swap responsibility every 12 months for the communication connections to overseas 
embassies. Sometime thereafter, Congress passed a law establishing a White House agency with the 
responsibility for secure diplomatic telecommunications. POWELL convinced the administration to give 
him time to assess the situation, so he launched a study to determine the agency best suited to maintain 
the communication connections. The study found CIA as the most competent, so POWELL fired State 
and reached an agreement with the then CIA Director GEORGE TENET where POWELL would select 
and evaluate the CIA staff person in charge of the system. Additionally, the system would be based on 
POWELL's requirements. 


(U//FOUO) In 2001, few State employees had a computer at their desks. Typically, there was one 
computer per office, so POWELL budgeted for the purchase of 44,000 computers and put one on every 
embassy desk. The project was done in-house without contractors. To convince and encourage others to 
use computers, POWELL frequently used his to set an example. When traveling to visit embassies, he 
would sit down at a random computer in each embassy and attempt to login to his account. This action 
allowed POWELL to gauge if the embassy staff was maintaining and using their computers 
Additionally, he would frequently look up Country Notes pages on the State intranet to determine if the 
various bureaus of State were keeping their information up to date. On his desk at State, POWELL had a 
State classified computer and a laptop with a 56kbps modem. The modem was used to access 
POWELL's personal American Online (AOL) account. He viewed his personal email much like a home 
telephone line in that it could be used for personal and business purposes. At times, POWELL would 
correspond with foreign leaders by email. If the conversation became sensitive, whether with foreign 
leaders or other USG personnel, he would arrange for a secure call. 
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(U//EGUO) The IT transformation revolutionized business at State. With a computer on every 
desktop, the time and space problems were eliminated when sharing information. Prior to the IT 
deployment, embassies communicated via cables. 


(U//FOGUO) The State Inspector General (IG) and Intelligence Community Inspector General 
(ICIG) both wrote POWELL to ask him if he had any emails from his time as Secretary of State. 
However, POWELL took no emails with him when he left State and knew of no official record 
requirements at the time, however, State claimed they were capturing any data necessary. POWELL has 
not been able to get a straight answer from the federal archives regarding what record requirements were 
at the time. He is concerned the current environment will discourage open communication and the use of 
email, ultimately harming US Government efficiency. 


(U//FG8O) When POWELL traveled for State business, a team would put a computer in his hotel 


room for general use, but he would also have access to State systems. Some threat countries would have 
additional security requirements such ERRARE EL S| If the need arose 


to have a classified conversation, POWELL would go to a secure facility, such as the local embassy. b1 per Dos 


(U//FGUO) In response to reviewing the email attached to this communication in a ІА, 
POWELL provided the following: 


(U//F8U9) During POWELL's first few weeks at State, he received several security briefings that 
restricted his ability to communicate. He was admonished that CIA and NSA did not want personal 
digital assistants (PDAs) inside of SCIFs, even if the PDA did not have wireless capabilities, He 
requested briefings to explain why PDAs were any more of a risk than the television remote controls in 
the SCIF, but was not convinced of the risks. As a result of these experiences, he advised HILLARY 


CLINTON, when she became Secretary of State, to resist restrictions that would inhibit her ability to 
communicate 


HRC-247 
SEeRÉT. 


